I submitted a false positive

AVG Internet Security / AVG Antivirus AVG Antivirus / AVG Internet Security for PC
1

I submitted a false positive and its been a week and a half and yet haven’t heard anything back from AVG support and clients website is still being block, is there anyone that can help?

2

Hi @Zayd_Adams,
Please could you send me details of your false posative submission so I can raise this with the approprate team.

3

Hi @AVG_Laurence,

Thank you — details below.

Submission

  • Submitted: 1 September 2026

  • Submitting email: (Email hidden by admin)

  • Domain: pharmapropertygroup.com

  • Detection name: URL:Phishing

  • Alert ID: e58242f1bf60/2026-09-01T14:43:10.571Z

A parallel submission was also filed with Avast for the same domain.

Context

This is the website of Pharma Property Group, a US commercial real estate brokerage specialising in pharmacy and drugstore properties. The site was compromised earlier in 2026. We were engaged to perform the incident response and remediation completed on 1 September 2026. We believe the classification is residual from the compromise window and has not been re-evaluated since.

The detection appears to be a blanket domain entry rather than an assessment of content. AVG blocks every resource from the domain — including /favicon.ico, a static 15 KB Windows icon file, reported as URL:Phishing. It also blocks /wp-admin/admin-ajax.php, WordPress’s standard AJAX endpoint, which returns a one-byte response of 0. I’m happy to supply screenshots of both.

Independent verification, current as of today

  • Google Safe Browsing: clean

  • OpenPhish: clean

  • PhishTank: clean

  • Phishing Database: clean

  • Sucuri SiteCheck: clean — no blacklist entries, no malware, no warnings; TLS rated A

  • SURBL: not listed

  • Cloudflare’s malware-filtering resolvers (1.1.1.2 / 1.1.1.3), Quad9 and OpenDNS all resolve the domain normally

  • Webroot, BitDefender, ESET, Sophos, Kaspersky, Yandex: all clean

  • 55 of the 63 VirusTotal engines returning a verdict report it clean

All three specialist phishing blocklists report it clean, which we’d suggest is directly relevant to a URL:Phishing classification specifically. Fortinet, which had rated the domain as Malware, reviewed our request and cleared it within one business day on 2 September.

Remediation completed: an attacker-installed phpMyAdmin instance that was publicly reachable has been removed from the web root and returns 404; all 13 known backdoor paths return 404; publicly downloadable site archives removed; attacker-installed themes removed; a publicly readable plugin inventory and a stale credentials file removed; all insecure http:// references eliminated site-wide, verified across 59 pages; security response headers deployed. We are continuing to remove legacy code as we find it.

I can provide the full remediation report, a file-level change log, or read-only server access for verification — whatever is most useful to the team.

Thanks again for picking this up.

4

Thanks for this information @Zayd_Adams, I have hidden your email address as you may not want it visible in a public forum.
I have passed it on to our team to review and follow up with you on.

5

@Zayd_Adams, this site should now be whitelisted.
Please let me know if you continue to experience issues?

6

thanks @AVG_Laurence I can see it running perfectly now, much appreciated!

1 Like
7

It is important to report false positives when legitimate software or files are incorrectly detected as threats. It is helpful to know what triggered the detection and how AVG reviews these submissions, especially when the file is confirmed to be safe.

8

Reporting a false positive is important when legitimate software or files are incorrectly detected as a threat. It would be helpful to know what triggered the detection and how AVG reviews these submissions, especially when the file is confirmed to be safe.

9

False positives can be frustrating, especially when a legitimate file or application is being flagged by AVG. It would be helpful to know what was detected and whether the submission has already been reviewed, so others can better understand how AVG handles these cases.

10

Glad they finally got it whitelisted! False positives can really hurt a business when customers can’t access the website for days