[dharmab]

I once worked for a company which was using a subdomain of an internal development domain to do some completely internal security research on our own products. The entire domain got flagged in Safe Browsing despite never being exposed to the outside world. We think Chrome's telemetry flagged it, and since it was technically routable as a public IP (all public traffic on that IP was blackholed), Chrome thought it was a public website.

[mkl95]

I saw a similar thing happen with a QA team's domains. Google flagged them as malicious and the company never managed to get them unflagged.

[dharmab]

Our lawyers knew their lawyers so there was a friendly chat and we got added to an internal whitelist within Google.