[Urgent] SmartScreen False Positive - No response to multiple appeals for imclient.herokuapp.com

Question

Hello,

I am writing this post as a last resort because our domain, imclient.herokuapp.com, continues to be blocked by Microsoft Defender SmartScreen with a "red screen" warning, despite multiple appeals.

We have followed the official appeal process (Appeal -> Wait 24 hours -> Follow-up email) twice now, but we have received no response, and the block remains active. This is causing significant disruption to our users.

1. Domain Status & Context

The domain imclient.herokuapp.com is a legitimate platform for web-based productivity tools. It contains zero malware, phishing content, or security threats.

VirusTotal Result (0/95 Clean): https://www.virustotal.com/gui/url/1ba9058ceca941ac10fd937d49e9d1d4ae2b42c6a9739dfa36715dcbe26031f0

Other major security vendors like Cisco Talos (Favorable), Symantec (Technology/Internet), and Webroot have already verified and cleared our domain.

2. Verified Apps on Google Workspace Marketplace

The web applications hosted on this domain are not random scripts; they are professionally developed tools registered and vetted on the Google Workspace Marketplace.

https://workspace.google.com/marketplace/app/video_uploader_for_dropbox_drive/872238254327
https://workspace.google.com/marketplace/app/cloud_audio_recorder/16125005200
https://workspace.google.com/marketplace/app/mobi_viewer_and_reader/1046109784677
https://workspace.google.com/marketplace/app/docx_viewer_and_reader/317991772601
https://workspace.google.com/marketplace/app/pdf_editor_for_drive_dropbox/949815188868
https://workspace.google.com/marketplace/app/screen_capture_to_video_file/369439223482
https://workspace.google.com/marketplace/app/save_files_to_dropbox/748420716766
https://workspace.google.com/marketplace/app/telegram_and_jabber_xmpp_messenger/365365490029

3. The Issue with SmartScreen

Currently, the entire domain is flagged as a threat in Microsoft Edge. We have submitted multiple "Report that this site does not contain threats" requests, but the block has not been lifted for over 48 hours since the last follow-up.

It is highly frustrating that while all other major browsers (Chrome, Safari, etc.) and security vendors recognize our site as safe, only Microsoft Edge continues this "False Positive" block. This unwarranted restriction is harming our reputation and preventing users from accessing their legitimate workspace tools.

Please review the classification of imclient.herokuapp.com and lift the SmartScreen block immediately.

How can I finally get this resolved? Does anyone here have advice or a direct contact for the SmartScreen team?

It is incredibly frustrating that Microsoft is not responding at all to our legitimate appeals. Any help or guidance from the community would be greatly appreciated.

Answer 1

SmartScreen warnings and blocks are based on multiple reputation and security signals, and they can occasionally result in false positives.

For a site that is being incorrectly blocked in Microsoft Edge, the supported paths are:

1. Use the built-in SmartScreen appeal flow as the site owner
   • On the SmartScreen block page in Edge, select Report that this site doesn't contain (malware/phishing) threats under the More information section.
   • This sends the case to the SmartScreen Reputation Group for review.
   • After submitting, wait for the confirmation email from the Reputation Group.
   • If the issue is urgent or no action appears to have been taken, reply directly to that confirmation email to escalate and present details such as business impact, VirusTotal results, and third‑party reputations.
2. Submit via the WDSI portal
   • In addition to the in-browser report, submit the URL using the WDSI file submission portal. This portal is also used for URL and network protection detections.
   • Follow the guidance in Submit files for analysis to provide as much supporting information as possible (for example, that other vendors classify the site as clean, and that it hosts business applications).
3. Use the SmartScreen-specific reporting channel
   • For SmartScreen-related false positives, use the SmartScreen feedback channel referenced under the Smartscreen detection source: Report an unsafe site or submit a network protection detection. These routes are designed specifically for SmartScreen and related protections.
4. Improve site characteristics that affect reputation SmartScreen evaluates several dimensions when deciding to block a site. To reduce the chance of continued or future blocking:
   • Ensure URL reputation is as strong as possible: avoid frequent hosting/DNS changes and maintain a stable, legitimate presence.
   • Review page content to ensure there are no elements that resemble deceptive forms, phishing flows, or obfuscated/malicious scripts.
   • Check file behavior: if the site serves downloads, ensure they are properly signed and not triggering AV engines.
   • Ensure TLS security is correctly configured with a valid certificate and modern protocol versions.
   • Encourage legitimate users to use the “Report that this site doesn’t contain threats” option on the block page; user feedback is one of the inputs SmartScreen uses.
5. If not the site owner
   • If others encounter the block, they should contact the site owner and ask them to follow the owner steps above.
   • Both the site owner and affected users can submit via the WDSI portal as additional supporting reports.

There is no direct public support contact for the SmartScreen team beyond these channels; resolution depends on submitting through the official reporting mechanisms and ensuring the site aligns with SmartScreen’s reputation and security criteria.

---

References:

• Unexpected SmartScreen block or warning on website
• Microsoft Edge support for Microsoft Defender SmartScreen
• Address false positives/negatives in Microsoft Defender for Endpoint
• Address false positives or false negatives in Microsoft Defender XDR