Anyone Dealing With Repeated Fake Abuse Reports Against Their Domain?

Hi everyone,

I'm dealing with a strange reputation issue and would like to hear from anyone who has experienced something similar.

I operate a legitimate domain with a simple landing page. No login forms, credential collection, malware downloads, or C2 functionality.

Recently, the domain started receiving repeated phishing/malware abuse reports every 1–2 days.

The pattern is:

• Cloudflare receives an abuse report and shows a "Suspected Phishing" warning.
• I submit a review with evidence, and Cloudflare removes the warning.
• A day or two later, another report appears.
• My registrar has also received malware/RAT/phishing/botnet reports and temporarily put the domain under ClientHold review.
• The investigation was resolved, but new reports keep appearing.
• Meanwhile, multiple security vendors are now flagging the domain, which is damaging its reputation and may create a feedback loop.

The current site is only a landing page hosted on Cloudflare Workers & Pages.

I am already contacting the vendors that currently flag the domain and requesting reclassification, but I'm looking for a better long-term solution.

Has anyone dealt with repeated false abuse reports like this?

I'm particularly interested in:

1. How did you recover your domain reputation across security vendors?
2. Is there a way to determine whether the same source is repeatedly submitting these reports?
3. How can you identify the original threat-intelligence source behind these detections?
4. Is there a recommended process for dealing with Cloudflare, Cisco Talos, Bitdefender, Fortinet, Sophos, etc.?
5. Is there a way to prevent legitimate domains from being repeatedly affected after previous reports have already been reviewed and cleared?

I'm not looking to bypass abuse systems or hide anything malicious. I want to resolve the issue through the proper security/reputation channels.

If you've experienced something similar, I'd really appreciate hearing what actually worked for you.

Thanks!

I’d start saving a snapshot every time this happens.

HTML, DNS, redirects, any external scripts. If the site is literally unchanged each time it gets flagged again, that’s useful evidence when you push it past the normal review queue

i'd start by finding the common source behind the reports instead of chasing every vendor separately. keep a record of timestamps, report types, and responses. several vendors may simply be using the same threat intel feed. also check your Cloudflare logs and Workers history carefully.

changing the domain would be my last resort. i'd document everything, trace the source, and work through the vendors one by one.

This sounds like a reputation/feed-propagation issue rather than an actual compromise.Keep records of every report and ask vendors for the original/upstream threat-intelligence source.Submit consistent false-positive/reclassification requests to Cloudflare, Talos, Fortinet, Sophos, Bitdefender, etc.Also monitor DNS, redirects, Worker activity, and logs to rule out any recurring technical trigger.

I also have seen a few similar cases where false positives keep spreading once a domain gets flagged by some vendors. I think the best approach is to normally check each blacklist source, submitting reviews with proof and monitoring reputation regularly until it getss clear.