FalsePositive.website

How to clear a false positive on VirusTotal

Websites, URLs and files·6 min read·Published ·Updated
01

First, what is VirusTotal?

VirusTotal is a website where anyone can look up a URL, a domain or a file. The report for your website lists the verdict of each security vendor that scans it, one row per vendor.

VirusTotal says it "only aggregates data from a variety of vendors. We produce no verdicts of our own and as such, we can't modify these results." A detection on your report belongs to the vendor that produced it, and only that vendor can remove it.

02

Who this affects

Nobody is blocked by VirusTotal
VirusTotal does not block your website. It only shows what other vendors say about it.
People who look your site up
Customers, partners and reviewers who check your domain on VirusTotal see the detections and can doubt your site.
Users of each flagging engine
People who run the security product of a vendor on your report can be warned or blocked by that product.
03

Who decides the result

04

How to read your report

  1. The Detection tab. Open the report for your URL or domain at virustotal.com. Each row is one vendor and shows what that vendor says about you.
  2. The date of the last analysis. VirusTotal caches some URL results, so the report can show an old verdict after a vendor has changed it.
  3. Our checker. The checker on our home page takes your report link and lists only the engines that flag it.
What the count means
1/60 or 5/60VirusTotal says this does not automatically mean "Bad". One vendor or five out of sixty is a reason to look at which vendors, not a verdict.
0/60VirusTotal says this does not always mean good.
05

Getting the detections removed

1

Reanalyse the report first

Open your report for the website and click Reanalyze. VirusTotal says to try re-scanning first, because the detection can be old. Check the Detection tab again when the scan finishes. If no vendor flags the site any more, you are done.

VirusTotal report page for the domain example.com with the Reanalyze button and the Detection tab
2

List the engines that still flag you

For each vendor that still flags the website, write down the detection name from its row. Copy the link to your VirusTotal report as well. Start with the engines your visitors use.

3

Contact each vendor

VirusTotal tells you to reach out to the vendor that produces the detection and to provide a link to the VirusTotal report. The contacts are on VirusTotal's false positive contacts page. Many vendors also have a guide on this site. If you write to VirusTotal instead, it will tell you to reach out to the vendors. Send a vendor the full URL of the website, the detection name, who owns the site and what it does. A website has no file to attach. Send a file only when the report is for a file, and add its SHA-256 hash. In the samples below, the report link is written in defanged form. Use the normal link in your message.

VirusTotal false positive contacts page with a table of vendors and how to reach each one 
Website flagged as phishing

To:       false positive contact of the vendor
Subject:  False positive: hxxps://example[.]com flagged as phishing
Body:     Hello,
          Your engine flags our website hxxps://example[.]com as
          phishing. The detection name is <name shown on the report>.
          VirusTotal report:
          hxxps://www[.]virustotal[.]com/gui/domain/example[.]com
          We own the domain and run the site ourselves. The only
          form is the customer login, and it sends data to our own
          server. The site has no downloads. Please review the
          verdict and remove the detection.

File flagged as malware

To:       false positive contact of the vendor
Subject:  False positive: example-app-setup.exe
Attach:   example-app-setup.zip
Body:     Hello,
          Your engine detects the installer of our product
          Example App 2.1 as <name shown on the report>. We built
          it from our own source. The official download page is
          hxxps://example[.]com/download and the SHA-256 hash is
          <hash>.
          VirusTotal report:
          hxxps://www[.]virustotal[.]com/gui/file/<hash>
          Please review the verdict and remove the detection.
4

Reanalyse after each vendor confirms

When a vendor tells you it has removed the detection, open your report and click Reanalyze again. VirusTotal states no turnaround. It depends on each vendor. Do the same for every vendor on your list.

5

If a URL stays cached

VirusTotal says: "We cache some URL results." If the vendors have confirmed removal and your URL still shows a detection, use the VirusTotal False Positive form. Under Subject, choose "My site/file has been improperly flagged as harmful (false positive)". Add evidence that the vendor has removed your URL from the blacklist, such as the vendor's reply. The form labels its email field "Your corporate email address". We have not tested whether it accepts a personal address. This route is for URLs only.

VirusTotal contact form with the subject, corporate email address and details fields
06

Other ways to report

VirusTotal explains its own rules for false positives on these pages:

07

A few things worth knowing

If you contact VirusTotal about a detection, it will tell you to contact the vendors. Go to the vendors first.
Start with the engines your visitors use. A detection in a product nobody on your audience runs costs you less than one in a popular browser or antivirus.
Keep the link to your VirusTotal report. Every vendor contact asks for it, and it shows the vendor what it flagged.
A report with one or five detections is not proof of a problem. VirusTotal says 0/60 does not always mean good either.
A new URL or a new build of a file gets its own report, so a fix on one report does not cover the next.
No contact for an engine on your report
Tell us which engines flag you and we'll point you to the right channel.
Get help