A vendor marks your website as malicious or phishing. On VirusTotal you see red verdicts; customers see block pages; your emails stop arriving.
Here is what the labels mean and how to get rid of them.
Key takeaways
- Malicious usually refers to malware; phishing refers to pages that steal credentials or payments.
- Many vendors use a combined "malicious or phishing" category.
- Phishing labels on clean sites are often triggered by login, payment or brand-related pages.
- Fix the cause, then dispute with each vendor individually.
Malicious versus phishing
Vendors use the labels like this:
- Malicious / Malware: the site distributes or loads harmful software, often through injected scripts or infected downloads.
- Phishing: the site imitates a trusted brand or service to collect logins, payment data or personal information.
- Malicious or phishing: a combined category used by some web filters and engines when the exact type is unclear.
Why legitimate sites get these labels
In our experience the most common causes are:
- A real compromise, such as a hidden phishing kit or injected redirect.
- Login, checkout or account pages that resemble phishing templates.
- Pages that mention or show logos of banks, payment providers or large brands.
- A domain name similar to a well-known brand.
- Hosting on infrastructure abused by phishing campaigns.
Our article on why clean websites get phishing warnings explains how automated classifiers make these mistakes.
Check for a compromise first
Search your server for unfamiliar folders and HTML files, especially ones imitating other brands. Check Google Search Console for Security Issues and test your site while logged out from a phone. See how to check if WordPress is hacked for a full checklist.
Dispute with each vendor
Use VirusTotal to list every vendor with a malicious or phishing verdict. Phishing labels often spread to feeds such as PhishTank, OpenPhish and Netcraft, so check those too. Submit a request to each vendor with the URL, a business description and evidence; our evidence checklist shows what to include.
Prevent a repeat
Add clear company information and contact details near login and payment pages, avoid using third-party brand logos unnecessarily and keep your CMS secure. Our phishing warning guide and prevention guide cover more.
Frequently asked questions
Is a phishing label worse than a malicious label?
Both block visitors. Phishing labels tend to spread faster through shared feeds, so act quickly.
How long does removal take?
Most vendors respond within one to five working days. Google phishing reviews are often completed within a day.
Do I have to change my login page?
Not necessarily. Clear branding, company details and a valid certificate usually satisfy reviewers.
Can a competitor report my site as phishing?
Anyone can submit a report, but vendors verify reports before listing. A false report can be disputed like any false positive.