Webroot BrightCloud blocked your domain. Our experts handle removal.
About the vendor
Webroot, now part of OpenText/Carbonite, is known for their cloud-based threat intelligence platform, Webroot BrightCloud. BrightCloud provides URL categorization and IP reputation data that is licensed to hundreds of third-party security vendors including Cisco Meraki, Barracuda Networks, Palo Alto Networks (via integration), and many others. BrightCloud processes over 95% of active IP addresses and classifies billions of URLs.
BrightCloud's data is embedded in hundreds of security products. Because so many vendors license BrightCloud data, a single Webroot/BrightCloud listing can propagate simultaneously across many different enterprise security products, blocking your domain in Cisco Meraki networks, Barracuda appliances, and scores of other products at once.
Common causes
From our own case data
Based on 15 removal cases we handled. We only show a removal figure once we have at least 5 cases.
Removal at a glance
Last updated
Complete removal guide
On VirusTotal, confirm Webroot flags your URL or domain and note the label and scan date. Check the vendor lookup too: https://www.brightcloud.com/tools/url-ip-lookup.php. Click Reanalyze first; stale cached verdicts are common.
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
Use the BrightCloud change request at https://support.threatintel.opentext.com/tools/change-request.php. No login. Comment field is limited to about 150 characters. Enter the exact URL(s), pick the correct category if asked and say why the verdict is wrong. Save the confirmation or ticket number. Also use the Webroot vendor dispute ticket (https://www.webroot.com/us/en/business/support/vendor-dispute-contact-us): "Create ticket now" works without an account; the subject field is short. Webroot uses the BrightCloud (OpenText) reputation database. Keep subjects and comments short: both forms truncate or reject long text.
No reply or change on VirusTotal after 24 hours? Reply once in the same thread or ticket with your reference; never open duplicates. Then try the other form. If declined, ask what evidence they need.
This step works the same way for every vendor, so the full instructions are in our VirusTotal false positive guide. Read the full step
The evidence checklist, follow-up routine and checks after removal are the same for every vendor. We keep them in one place so this page can focus on what is specific to Webroot.
Read the VirusTotal false positive guideFAQ
We check that your site is clean, send Webroot the evidence it needs through its official channel and follow up until the flag is gone. You only pay once the removal is confirmed, and the full process for 90+ vendors is explained on our website blacklist removal page.
Picked for the same vendors and the same kind of problem.
Ask AI
Open this page in your favourite AI assistant with a ready-made question, and ask follow-ups about your own domain.