When people say their domain is "blacklisted in VirusTotal", they usually mean that the domain report shows one or more red detections. VirusTotal does not run a blacklist of its own, but the vendors it displays do, and their lists are used by firewalls, mail servers and browsers around the world.
Here is how to diagnose the listing, limit the damage and get your domain cleared.
Key takeaways
- "Blacklisted in VirusTotal" means one or more partner vendors list your domain.
- Domain-level listings affect every page and every email that mentions the domain.
- Fix the root cause first, then contact each vendor with evidence.
- Monitor the domain afterwards, because listings often spread between vendors.
What a VirusTotal domain listing means
Every domain has a report on VirusTotal that combines the verdicts of 90+ vendors. If even one of them classifies the domain as malicious, phishing, malware or spam, the report shows a detection.
Domain listings are more serious than a single flagged URL, because security tools apply them to everything on the domain: every page, every subdomain and every email that contains a link to it. If you are unsure whether your problem is the web domain or email, read domain blacklist versus email blacklist.
Signs your blacklisted domain is costing you
A listing on VirusTotal often shows up first as a business problem rather than a security one:
- Newsletters and transactional emails suddenly land in spam or bounce.
- Corporate customers report that their network blocks your site.
- Google Ads or Meta rejects your landing pages for "malicious software".
- Browser extensions or antivirus software show warnings to visitors.
- Payment providers or marketplaces ask questions about your domain.
Step 1: Find out who listed you and why
Open the domain report and write down each vendor that flags you, with its label. Then check the Relations tab for flagged URLs, downloaded files and communicating samples. These often reveal the actual trigger, such as one compromised page or an old file.
Also check that your site is clean today. Look for unknown admin users, modified theme files, unexpected redirects and outdated plugins.
Step 2: Clean up and collect evidence
Remove whatever caused the listing and record what you did. Vendors respond much faster when the request is backed by evidence. Our delisting evidence checklist covers what to include, from clean scan results to a short description of your business.
Step 3: Request removal from each vendor
Each vendor on VirusTotal handles disputes separately. Some of the vendors that most often list domains are CRDF, alphaMountain.ai, Bitdefender and Fortinet. Our guide to reporting false positives to security vendors lists the correct channels.
Send one clear request per vendor, keep track of ticket numbers and follow up after a few working days.
Do not mass-submit the same request to the same vendor. Duplicate tickets are often closed without review.
Step 4: Verify and monitor
Once a vendor confirms removal, rescan the domain on VirusTotal so the public report updates. Keep monitoring for a few weeks: vendors that share threat feeds sometimes pick up an old listing after the original vendor has removed it.
Frequently asked questions
Can VirusTotal remove my domain from its blacklist?
No. VirusTotal only shows vendor verdicts. Each vendor has to remove the listing itself.
How many detections is too many?
Any detection can cause blocking somewhere. Prioritise detections from widely used vendors and those labelled phishing or malware.
Will my domain be clean after I fix the hack?
Not automatically. Vendors rarely recheck on their own, so you need to request a review.
Should I move to a new domain instead?
Almost never. A new domain has no reputation and is more likely to be flagged. Cleaning up the existing domain is faster and keeps your SEO.