Case Study: 12 Vendors Flagged an Agency Client's Site. 12 Cleared Within 15 Days.
In August 2026 a digital marketing agency's client website — never hacked — was flagged by ESET and, on scanning, by 11 other security vendors. After a one-time €39 dispatch of 12 separately written removal requests, our automated re-scans found 8 of 12 vendors cleared by day 3, the same 8 at day 7, and all 12 cleared by day 15. One domain is a case, not a rate.
The situation
The owner of a digital marketing agency in Hungary noticed ESET blocking a client's website. The site had not been hacked; nothing had changed on it. The agency owner ran the free scan and found that ESET was one of 12 vendors returning the domain — the others were antivirus engines and web blocklists that had picked up the same verdict or reached their own. The site was clean, so the only work left was the requests.
What was sent
After payment the domain was re-scanned so the dispatch ran against current results, then 12 plain-text requests went out over one hour — one per vendor, each written for that vendor's format, no attachments, no marketing language, with the customer's own address as Reply-To. Vendor replies went to him, not to us. Nothing was sent to a form-only vendor on his behalf; those come as prepared cards.
What the readings showed
| Day 0 | Scan: 12 vendors flagging, ESET among them. Payment. Re-scan (cache ignored). 12 separately written requests dispatched over one hour, Reply-To the customer's address. |
|---|---|
| Day 3 | Automated re-scan: 8 of 12 vendors no longer returned the domain. |
| Day 7 | Automated re-scan: 8 of 12 — the same eight. The remaining four had not moved. |
| Day 15 | Manual read-only scan: all 12 cleared. VirusTotal's last analysis was dated day 15, so 15 is the latest day by which every vendor had cleared — not a flattering guess at when it happened. |
What this does and does not show
- It shows that on a genuinely clean site, most vendors that accept a request act within a week, and the slow ones within about two.
- It does not show a rate. One dispatch is one dispatch. The per-vendor table on the data report grows as dispatches are measured, and a vendor only gets a row there after three domains.
- It does not show why a vendor cleared. A vendor may have acted on the request, re-crawled on its own, or expired the entry. We record what the scanners return, not the vendor's reasoning.
“ESET flagged our client's website even though it had never been hacked. I wasn't sure whether I could trust an online service with this, but I decided to give it a try. Two weeks later, all 12 vendors that had flagged the site, including ESET, had cleared it.”