Your domain is flagged in AlienVault OTX. Our experts handle the removal.
About the vendor
AlienVault OTX (Open Threat Exchange), now operated by LevelBlue (AT&T Cybersecurity), is one of the largest open threat intelligence communities in the world. Over 100,000 security researchers and analysts share indicators of compromise (IOCs), including malicious domains, IPs, and URLs, directly on the platform. OTX data feeds automatically into USM Anywhere, OSSIM, and via a widely-used API into hundreds of third-party SIEM, SOAR, and EDR products.
An AlienVault OTX listing is public and immediately machine-readable. Within hours of appearing, your domain can be ingested by enterprise SIEM systems globally and trigger automated blocking rules, locking out corporate users silently and without explanation.
Common causes
From our own case data
Not enough data yet for median days to removal, removal success rate, most common reason and last delisting date.
We have not handled a AlienVault removal case yet. We only show a removal figure once we have at least 5 cases.
Removal at a glance
Last updated
Complete removal guide
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
Email otx-support@alienvault.com. Subject: "False positive: example[.]com" plus your reference. Plain text, no links or attachments, domains defanged. Give the URL(s), VirusTotal label, what the site does, why the verdict is wrong and what you fixed. AlienVault OTX verdicts are driven by community pulses. Mention the pulse or indicator if you can see it on the OTX indicator page.
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
The evidence checklist, follow-up routine and checks after removal are the same for every vendor. We keep them in one place so this page can focus on what is specific to AlienVault.
Read the VirusTotal false positive guideFAQ
We check that your site is clean, send AlienVault the evidence it needs through its official channel and follow up until the flag is gone. You only pay once the removal is confirmed, and the full process for 90+ vendors is explained on our website blacklist removal page.
Picked for the same vendors and the same kind of problem.
Ask AI
Open this page in your favourite AI assistant with a ready-made question, and ask follow-ups about your own domain.