Cluster25 cited your domain in threat research. We handle the challenge.
About the vendor
Cluster25 is an Italian threat intelligence company focused on advanced persistent threat (APT) tracking, adversary profiling, and tactical threat intelligence for government and enterprise clients. They publish research on nation-state actors and their supporting infrastructure. Appearing in Cluster25's intelligence reports, even as a victim of infrastructure abuse, can cause your domain to be flagged in threat reports consumed by government bodies and large enterprise security teams.
Cluster25 threat reports reach government agencies, defence contractors, and large enterprises as formal security intelligence. A domain associated with their research is treated with the highest level of suspicion, often resulting in immediate blocking across multiple organizations and potential inclusion in national threat-sharing frameworks.
Common causes
From our own case data
Not enough data yet for median days to removal, removal success rate, most common reason and last delisting date.
Based on 1 removal case we handled. We only show a removal figure once we have at least 5 cases.
Removal at a glance
Last updated
Complete removal guide
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
Email threatintel@cluster25.io. Subject: "False positive: example[.]com" plus your reference. Plain text, no links or attachments, domains defanged. Give the URL(s), VirusTotal label, what the site does, why the verdict is wrong and what you fixed.
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
The evidence checklist, follow-up routine and checks after removal are the same for every vendor. We keep them in one place so this page can focus on what is specific to Cluster25.
Read the VirusTotal false positive guideFAQ
We check that your site is clean, send Cluster25 the evidence it needs through its official channel and follow up until the flag is gone. You only pay once the removal is confirmed, and the full process for 90+ vendors is explained on our website blacklist removal page.
Picked for the same vendors and the same kind of problem.
Ask AI
Open this page in your favourite AI assistant with a ready-made question, and ask follow-ups about your own domain.