How Many VirusTotal Detections Is Bad? 1/70, 2/70, 3/70
No number of VirusTotal detections is bad or safe on its own. VirusTotal produces no verdicts of its own (VirusTotal); a ratio like 2/70 only says that two of the scanners it runs reported something. Which engines flagged you matters more than how many. For a website, one detection from an engine whose data reaches browsers, firewalls or antivirus products can block real visitors. For a file, one or two detections from lesser-known engines are often a false positive, but VirusTotal will not decide that for you.
TL;DR: There is no official threshold. Open the detection list and read the engine names. On a website, treat any engine that feeds browsers, antivirus web protection or company firewalls as a real block, whatever the total says. On a file, a low count can be a false positive or a sample so new that few engines know it yet. Either way, the only fix is a request to each vendor that flagged you; VirusTotal itself can't change a result.
Is there a VirusTotal detection threshold?
No. VirusTotal runs a submitted file or URL through more than 70 antivirus scanners and URL and domain blocklisting services (VirusTotal) and shows each answer side by side. Its documentation is explicit that each decision on whether something is malicious belongs to the user or to the security vendors, and that VirusTotal can't modify the results (VirusTotal). So "how many is too many" has no answer on VirusTotal's side. The score is a count, not a judgement.
Three things make the raw count misleading:
- Detections are not independent votes. Some antivirus products share the same detection engine or signatures, so three detections can be one bad signature counted three times (PCWorld, 2015).
- The engine on VirusTotal is not always the product on someone's computer. Vendors may tune their VirusTotal engines with stronger heuristics, cloud lookups and beta signatures (VirusTotal). A detection there doesn't prove the retail product blocks the same thing, and the reverse is also true.
- A company's URL scanner and its antivirus are often separate products. A URL flagged by one vendor's scanner doesn't mean the same vendor's antivirus flags the file served there (VirusTotal).
VirusTotal aggregates more than 70 antivirus scanners and URL blocklisting services and produces no verdict of its own (VirusTotal). A detection ratio is therefore a tally of separate vendor opinions, some of which share engines, and there is no number above which VirusTotal itself calls a file or website malicious.
What do 1/70, 2/70 and 3/70 mean?
The total changes depending on how many engines answered, which is why you see 1/68, 1/70 and 1/71 for the same kind of result. Read it as "this many engines reported something", then look at who they are.
| Result | If it's your website | If it's a file you downloaded |
|---|---|---|
| 1/70 | Find the engine. If it's Google Safebrowsing, an antivirus with web protection or a firewall vendor, visitors behind it are already blocked: dispute it now. | Can be one engine's heuristic, which vendors may set more aggressively on VirusTotal than in their products. Check the detection name and where the file came from before trusting or deleting it. |
| 2/70 | Check whether the two share a vendor. If they don't, each needs its own request; clearing one doesn't clear the other. | Same as one detection, unless the two names agree on a specific malware family. |
| 3/70 and up | Common for flagged sites (see the numbers below). Treat it as a list of vendors to contact, not as a score. | More reason to check, especially if several engines name the same family. A low count can also mean a sample so new that few engines detect it yet (PCWorld, 2015). |
Two engines that look different can share one database. Avast and AVG, for example, run the same threat database, which is why one report covers both (see our AVG page).
How many vendors usually flag a website?
More than most people expect, and the count varies a lot. Our October 2026 website blocklist report covers 223 domains scanned between 30 May and 27 September 2026; 92 of them were flagged by at least one vendor across the lists we check. This is how many vendors flagged each of those 92 at once:
| Vendors flagging the domain | Flagged domains | Share |
|---|---|---|
| 1 | 17 | 18% |
| 2 to 5 | 27 | 29% |
| 6 to 10 | 11 | 12% |
| 11 to 15 | 26 | 28% |
| 16 or more | 11 | 12% |
The median flagged domain was listed by 6 vendors; the most was 18. Read this with its bias in mind: these are domains someone checked because something seemed wrong, not a random sample of the web. Still, a single detection was the exception. Most flagged sites had several, and two in five had more than ten.
In our October 2026 report, 92 of 223 scanned domains were flagged by at least one security vendor. Only 18% of the flagged domains were flagged by a single vendor; the median was 6 vendors and the maximum 18 (unflagdomain website blocklist report).
Which detections matter most for a website?
The ones whose data reaches the places your visitors actually are. A website detection costs you something when it shows up as a block:
- Browsers. Google Safe Browsing (listed as "Google Safebrowsing" on VirusTotal) drives the red warning in Chrome, Safari and Firefox. It has its own review in Google Search Console, which only the site owner can request; see the Safe Browsing guide.
- Antivirus web protection. Engines such as Bitdefender, Kaspersky, ESET, Sophos and Webroot also sit in products that stop people opening a site.
- Firewalls and web filters. Vendors such as Fortinet and Forcepoint classify sites for company networks and for some internet providers' filters. A visitor at work or on a filtered connection gets a block page, and you never see it.
That last group is easy to underestimate. The owners who have bought from us so far mostly found out because an antivirus or their internet provider blocked the site, not because they looked at VirusTotal. Engines that only feed threat-intelligence lists still deserve a request, but a block that visitors hit comes first.
Our VirusTotal false positive guide lists the engines that flag websites most often in our scans, each with where it takes a report.
What should you do about the detections?
Work through the list, not the number.
- Open the report and expand the engine list. Write down every engine with a non-clean verdict: malicious, phishing, malware or suspicious.
- Re-scan first. VirusTotal's own advice for a false positive on a file or a URL is to re-scan before anything else, because the result you are looking at may be cached (VirusTotal).
- Make sure the site is clean. If it was hacked, finish the cleanup before you ask anyone to look again. Vendors re-check when they review a request, and a site that still serves something bad keeps its flag.
- Contact each vendor that still flags it. VirusTotal points you to the vendor, with a link to the VirusTotal report (VirusTotal). Each one has its own form or address, and each decides on its own timeline.
- Request Google's review yourself if Google Safebrowsing is on the list. Nobody can do it for you.
If it's a file rather than a website, the route is different: file detections go to each antivirus vendor's file submission. We handle websites only; this page shows where a file false positive goes.
see every vendor that flags your website, free
For a website with more than a couple of detections, the vendor-by-vendor part is where the hours go. unflagdomain writes a separate request for each flagging vendor that takes email, sends them for you with your address as Reply-To, and prepares the text for the vendors that only take a form or, like Google, a manual review. It guarantees that the requests go out, not that any vendor removes the flag: each vendor decides.
Not automatically, and not automatically dangerous. One detection means one engine reported something and the rest did not; VirusTotal adds no verdict of its own. For a website, check which engine it is: if it is Google Safebrowsing, an antivirus with web protection or a firewall vendor, visitors behind it are already blocked. For a file, it can be one engine's heuristic; check the detection name and where the file came from.
Two of the roughly 70 engines VirusTotal ran reported the file as malicious and the others did not. Read the two names. If they share a vendor or a threat database, it may be one detection counted twice; if both name the same malware family, take it seriously. Only the vendors can change their own results.
VirusTotal shows what each engine reports, and the engines can be wrong. Vendors may run stronger heuristics and beta signatures on VirusTotal than in their products, and some products share an engine, so one bad signature can appear as several detections. That is why VirusTotal sends a false positive to the vendor that produced it.
The engine on VirusTotal is not always configured like the product on your computer: vendors may tune it with stronger heuristics, cloud lookups and beta signatures. A vendor's URL scanner and its antivirus are also often separate products, so a flagged URL does not mean the antivirus flags the file served there, or the other way round.
The vendor that made it. VirusTotal states it cannot modify scan results. Re-scan first in case the result is cached, then contact each vendor that still flags you, with a link to the VirusTotal report. A Google Safe Browsing flag on a website is reviewed only through Google Search Console, by the site owner.