Few things are more confusing than seeing your domain labelled "malicious" on VirusTotal by a vendor you have never heard of. For many website owners, that vendor is CRDF.
This article explains who CRDF is, why its engine flags legitimate websites and how to get a CRDF false positive removed for good.
Key takeaways
- CRDF Threat Center is a French threat intelligence service whose verdicts appear on VirusTotal.
- Its listings are largely automated and often triggered by shared infrastructure or old abuse reports.
- Removal requires a clear request with evidence that your site is clean.
- After CRDF delists you, rescan on VirusTotal to update the public result.
What is CRDF?
CRDF Threat Center is a threat intelligence platform run by CRDF Labs in France. It collects malicious URLs from crawlers, partner feeds and user submissions, and publishes them as a blocklist. That blocklist is one of the engines VirusTotal queries, so a CRDF verdict shows up directly in your VirusTotal report.
You can find more details on our CRDF vendor page.
Why CRDF flags clean websites
Because CRDF relies heavily on automation, it can pick up domains that were only indirectly linked to abuse. Common causes include:
- Your domain appeared in a spam campaign, for example because someone abused your contact form or newsletter.
- A phishing kit or malware file was briefly hosted on your site in the past.
- Your site shares an IP address or hosting provider with malicious domains.
- A partner feed reported a URL on your domain without checking it again later.
Before you file a request, scan your site for injected code and remove anything suspicious. A request for a site that still contains malicious files will be rejected.
How to request removal from CRDF
CRDF accepts false positive reports through its Threat Center. A strong request follows these steps:
- Confirm that the detection is current by checking the latest VirusTotal scan.
- Collect evidence: a clean scan from a site checker, a description of your business and any cleanup you did.
- Submit the domain through the CRDF false positive or contact channel, stating clearly that it is a false positive.
- Keep the request short, factual and in English, and include the exact URL that is flagged.
- Wait for confirmation, then rescan the URL on VirusTotal.
How long does a CRDF removal take?
In our experience, well-documented requests are often handled within a few days, but response times vary. If you hear nothing after a week, a polite follow-up with the original details usually helps.
Use our delisting evidence checklist to make your first request complete, so it does not bounce back with questions.
Preventing CRDF listings in the future
Keep your CMS and plugins up to date, protect forms with spam protection and monitor your domain so you learn about a listing before your customers do. Continuous monitoring also tells you when other vendors pick up the same signal, which often happens within days of a CRDF listing.
Frequently asked questions
Is CRDF a legitimate security vendor?
Yes. CRDF Threat Center is an established threat intelligence provider and an official VirusTotal partner.
Does a CRDF detection affect my traffic?
It can. Some firewalls, email gateways and security tools use VirusTotal or CRDF data to block domains.
Do I need to contact VirusTotal as well?
No. Once CRDF removes your domain, a VirusTotal rescan will pick up the clean verdict.
Can CRDF list my domain again?
Yes, if new abuse is reported. Monitoring your domain lets you react quickly if that happens.