If someone told you your website "shows up red on VirusTotal", you are probably wondering who VirusTotal is and why they think your site is dangerous.
The short answer: VirusTotal does not think anything about your site. It is a free service, owned by Google, that asks dozens of security companies at once what they think of a file, URL, domain or IP address, then shows all of their answers on one page. This guide explains how that process works, how to read the results and what to do when they are wrong.
Key takeaways
- VirusTotal is an aggregator: it shows the opinions of 90+ independent security vendors, it does not issue its own verdict.
- A single vendor flag can be enough for firewalls and email filters to block your domain.
- VirusTotal cannot remove a detection for you. Each vendor must be contacted separately.
- Rescanning only refreshes the results. It does not fix a vendor that still lists you.
What VirusTotal actually is
VirusTotal launched in 2004 as a tool for checking suspicious files against many antivirus engines at once. Today it also scans URLs, domains and IP addresses, and it is used by millions of security analysts, IT teams and automated systems every day.
The key concept is aggregation. VirusTotal partners with more than 90 security vendors, including antivirus companies, threat intelligence feeds and URL blocklists such as CRDF, Bitdefender, alphaMountain.ai and Google Safe Browsing. When you submit something, VirusTotal shows each vendor's verdict side by side.
What happens when a URL is scanned
When a URL or domain is submitted, VirusTotal runs through a fixed sequence of steps:
- It fetches the page and records the final URL, redirects, HTTP response and page content.
- It sends the URL to every partner vendor that supports URL scanning, or looks up their latest verdict.
- Each vendor replies with a label such as clean, unrated, suspicious, phishing, malicious or malware.
- VirusTotal counts the vendors that call it suspicious or worse and shows that as the detection score, for example 3/94.
- It enriches the domain page with DNS records, WHOIS data, SSL certificates, related files and community votes.
The detection score is only a count, not a weighted risk rating. 1/94 from a small feed and 1/94 from a major vendor look identical on VirusTotal, yet they can have very different effects on your traffic.
Where the vendor verdicts come from
Each vendor builds its verdict in its own way. Some rely on automated crawlers and machine learning that score pages on look and behaviour. Others use human analysts, honeypots, spam traps or reports from their own customers.
That is why vendors often disagree. A brand-new domain with a login form may be flagged as phishing by an algorithm, while every other engine marks it clean. The vendor's data then spreads further, because firewalls, email gateways and browser extensions license these same feeds.
Why clean websites get flagged
Most detections we handle are false positives. The usual triggers are:
- A previous compromise that has been cleaned up, while the old listing is still active.
- Shared hosting or an IP address that a malicious site also used.
- Newly registered domains, URL shorteners or heavy redirect chains.
- Login pages, payment forms or brand names that pattern-match phishing kits.
- Downloads, obfuscated JavaScript or ad scripts that look like malware to a heuristic engine.
Read more in our article on why clean websites get phishing warnings.
How to read your VirusTotal report
Open the Detection tab and note which vendors flag you and which label they use. Phishing, malware and spam each need a different explanation. Then check the Details and Relations tabs: an old redirect, a suspicious file hosted on your domain or a shared IP can explain the flag.
Finally, look at when the last analysis took place. Results can be months old. Pressing Reanalyze refreshes the scan, but if a vendor still lists your domain in its own database, the detection will come straight back.
How to get a VirusTotal detection removed
Because VirusTotal only displays third-party verdicts, it cannot delete them. The fix is to contact every vendor that flags you, with evidence that the site is safe. Each vendor has its own form, email address or portal, and its own response times. Our VirusTotal false positive removal guide walks through the process, and our article on one vendor flagging your domain covers the most common situation.
If several vendors are involved, or your traffic, ads or email deliverability are already suffering, a managed removal case is usually the fastest route. We prepare the evidence, file with each vendor and track every listing until it is gone.
Frequently asked questions
Is VirusTotal itself flagging my website?
No. VirusTotal only shows the verdicts of its partner vendors. The vendor named next to the red label is the one that flagged you.
Will rescanning on VirusTotal remove the detection?
Only if the vendor has already removed you from its own list. Otherwise the same result comes back on every rescan.
How long does a VirusTotal false positive take to clear?
It depends on the vendor. Some respond within 24 hours, others take one or two weeks. After the vendor delists you, a new VirusTotal scan shows the updated result.
Does a VirusTotal detection affect my Google rankings?
Not directly. Detections by Google Safe Browsing, though, trigger browser warnings, and other vendors can block your site in firewalls and email filters. Both cost you traffic and conversions.