Which security vendors actually block websites
61% of the websites we scanned were listed on at least one security blocklist. Among those, the median site was flagged by 11 vendors simultaneously — and 58% of flagged sites carried 11 or more listings at once. The engines doing the flagging are mostly URL-reputation services — AlphaMountain, ADMINUSLabs, Chong Lua Dao, CyRadar — not the consumer antivirus brands most people expect.
59 domains scanned, 36 flagged, 25 distinct vendors observed. 2026-05-30 – 2026-09-02. Edition September 2026, cut 2026-09-03.
Methodology
Every figure comes from live scans run by unflagdomain.com, a paid blocklist-removal service. Detection sources: VirusTotal (aggregating around 90 engines), Google Safe Browsing, and Sucuri SiteCheck. A domain counts as flagged when at least one source reports at least one vendor listing it.
Percentages are shares of the 36 flagged domains unless stated otherwise, rounded to whole numbers — at this sample size a single new domain moves a share by roughly three points, so decimals would imply precision the corpus does not have.
Domains are submitted by people checking their own site, most of whom already suspect a problem. The flagged rate above is not a base rate for the web, and we would rather say so than let it be read as one. The corpus is young and grows with every scan; we publish it because no comparable dataset exists. Vendors publish what they detect. Nobody publishes who does the detecting.
Websites are almost never flagged by a single vendor
58% of flagged sites are listed by 11 or more vendors at the same time. Only 3% — a single site in the entire corpus — was flagged by exactly one vendor. The heaviest-hit site carried 18 listings.
| Vendors flagging the site | Share of flagged sites | Sites |
|---|---|---|
| 1 | 3% | 1 |
| 2–5 | 33% | 12 |
| 6–10 | 6% | 2 |
| 11–15 | 42% | 15 |
| 16+ | 17% | 6 |
Blocklists propagate. Once one reputation engine lists a domain, others consuming the same feeds follow within days. That is why “I’ll just email the one who flagged me” rarely ends the problem.
The vendors flagging websites are not the household names
Norton, McAfee, AVG and Avast flagged 0% of the sites in this corpus — not one — despite dominating search results for website-blocklist questions. A site owner preparing a removal request for Norton is preparing for the wrong conversation.
| Vendor | Share of flagged sites | Sites | Category | Removal channel |
|---|---|---|---|---|
| AlphaMountain | 75% | 27 | URL reputation | |
| ADMINUSLabs | 64% | 23 | URL reputation | |
| Chong Lua Dao | 64% | 23 | URL reputation | |
| CyRadar | 64% | 23 | Antivirus | |
| Webroot | 64% | 23 | Antivirus | Web form |
| Fortinet | 61% | 22 | Antivirus | Web form |
| Lionic | 61% | 22 | Antivirus | |
| BitDefender | 58% | 21 | Antivirus | |
| G DATA | 58% | 21 | Antivirus | Web form |
| Sophos | 58% | 21 | Antivirus | |
| Gridinsoft | 56% | 20 | Antivirus | |
| ESET | 47% | 17 | Antivirus | Web form |
| Vipre | 47% | 17 | Antivirus | |
| Forcepoint ThreatSeeker | 28% | 10 | URL reputation | |
| Kaspersky | 22% | 8 | Antivirus | |
| Emsisoft | 19% | 7 | Antivirus | |
| Netcraft | 19% | 7 | URL reputation | Web form |
| Rising | 19% | 7 | Antivirus | |
| CRDF | 17% | 6 | URL reputation | Web form |
| Dr.Web | 11% | 4 | Antivirus | |
| SOCRadar | 11% | 4 | URL reputation |
Every vendor wants to be contacted differently
Across the 25 vendors observed flagging sites, 72% accept a removal request by email, 24% accept only a web form, and 4% require manual submission through a console — Google Safe Browsing, via Search Console.
There is no shared standard, no common format, and no central registry. A site with the median 11 listings needs roughly that many separate requests, each in the shape its recipient expects.
The full table — all 25 vendors
| Vendor | Share of flagged sites | Sites | Category | Removal channel |
|---|---|---|---|---|
| AlphaMountain | 75% | 27 | URL reputation | |
| ADMINUSLabs | 64% | 23 | URL reputation | |
| Chong Lua Dao | 64% | 23 | URL reputation | |
| CyRadar | 64% | 23 | Antivirus | |
| Webroot | 64% | 23 | Antivirus | Web form |
| Fortinet | 61% | 22 | Antivirus | Web form |
| Lionic | 61% | 22 | Antivirus | |
| BitDefender | 58% | 21 | Antivirus | |
| G DATA | 58% | 21 | Antivirus | Web form |
| Sophos | 58% | 21 | Antivirus | |
| Gridinsoft | 56% | 20 | Antivirus | |
| ESET | 47% | 17 | Antivirus | Web form |
| Vipre | 47% | 17 | Antivirus | |
| Forcepoint ThreatSeeker | 28% | 10 | URL reputation | |
| Kaspersky | 22% | 8 | Antivirus | |
| Emsisoft | 19% | 7 | Antivirus | |
| Netcraft | 19% | 7 | URL reputation | Web form |
| Rising | 19% | 7 | Antivirus | |
| CRDF | 17% | 6 | URL reputation | Web form |
| Dr.Web | 11% | 4 | Antivirus | |
| SOCRadar | 11% | 4 | URL reputation | |
| MalwareURL | 8% | 3 | URL reputation | |
| Cluster25 | 3% | 1 | URL reputation | |
| Google Safe Browsing | 3% | 1 | Search engine | Manual console |
| Seclookup | 3% | 1 | URL reputation |
Vendors below 10% appear on a handful of sites each. They are shown for completeness; treat the tail as indicative rather than statistically meaningful. Google Safe Browsing sits low here by design — it flags far more narrowly than a URL-reputation engine, not because the pipeline missed it.
Take the data
GET https://unflagdomain.com/api/v1/statsPublic, unauthenticated, no key required. Returns the live corpus as JSON — this page shows a frozen edition so cited figures stay put, the API stays current. Free to use and cite; attribution appreciated.
About this data
unflagdomain.com is a paid service (€39 per domain, one-time) that sends removal requests to every vendor flagging a site. This dataset is a by-product of running it. We guarantee dispatch of correctly formatted requests, not delisting — each vendor decides independently and on its own timeline.
We publish the numbers because we would have wanted them before building this.