This is the archived October 2026 edition, kept unchanged so figures cited from it stay valid.

// BLOCKLIST REPORT

Which security vendors actually block websites

41% of the websites we scanned were listed on at least one security blocklist. Among those, the median site was flagged by 6 vendors simultaneously — and 40% of flagged sites carried 11 or more listings at once. The engines doing the flagging are mostly URL-reputation services — AlphaMountain, Gridinsoft, Fortinet, BitDefender — not the consumer antivirus brands most people expect.

// DATASET

223 domains scanned, 92 flagged, 35 distinct vendors observed. 2026-05-30 – 2026-09-27. Edition October 2026, cut 2026-10-01.

Methodology

Every figure comes from live scans run by unflagdomain.com, a paid blocklist-removal service. Detection sources: VirusTotal (aggregating around 90 engines), Google Safe Browsing, and Sucuri SiteCheck. A domain counts as flagged when at least one source reports at least one vendor listing it.

Percentages are shares of the 92 flagged domains unless stated otherwise, rounded to whole numbers — at this sample size a single new domain moves a share by roughly three points, so decimals would imply precision the corpus does not have.

Domains are submitted by people checking their own site, most of whom already suspect a problem. The flagged rate above is not a base rate for the web, and we would rather say so than let it be read as one. The corpus is young and grows with every scan; we publish it because no comparable dataset exists. Vendors publish what they detect. Nobody publishes who does the detecting.

Websites are almost never flagged by a single vendor

40% of flagged sites are listed by 11 or more vendors at the same time. Only 18% — 17 sites in the entire corpus — were flagged by exactly one vendor. The heaviest-hit site carried 18 listings.

Vendors flagging the site	Share of flagged sites	Sites
1	18%	17
2–5	29%	27
6–10	12%	11
11–15	28%	26
16+	12%	11

Blocklists propagate. Once one reputation engine lists a domain, others consuming the same feeds follow within days. That is why “I’ll just email the one who flagged me” rarely ends the problem.

The vendors flagging websites are not the household names

Norton, McAfee, AVG and Avast flagged 0% of the sites in this corpus — not one — despite dominating search results for website-blocklist questions. A site owner preparing a removal request for Norton is preparing for the wrong conversation.

Vendor	Share of flagged sites	Sites	Category	Removal channel
AlphaMountain	67%	62	URL reputation	Email
Gridinsoft	53%	49	Antivirus	Email
Fortinet	48%	44	Antivirus	Web form
BitDefender	42%	39	Antivirus	Email
CyRadar	42%	39	Antivirus	Email
Lionic	41%	38	Antivirus	Email
Webroot	40%	37	Antivirus	Web form
Chong Lua Dao	38%	35	URL reputation	Email
G DATA	38%	35	Antivirus	Web form
Sophos	36%	33	Antivirus	Email
ADMINUSLabs	33%	30	URL reputation	Email
CRDF	30%	28	URL reputation	Web form
ESET	30%	28	Antivirus	Email
Forcepoint ThreatSeeker	30%	28	URL reputation	Web form
Vipre	29%	27	Antivirus	Web form
SOCRadar	27%	25	URL reputation	Email
Rising	24%	22	Antivirus	Email
Kaspersky	21%	19	Antivirus	Email
MalwareURL	17%	16	URL reputation	Email
Netcraft	10%	9	URL reputation	Web form
Norton Safe Web	10%	9	URL reputation	Web form

Every vendor wants to be contacted differently

Across the 35 vendors observed flagging sites, 66% accept a removal request by email, 31% accept only a web form, and 3% require manual submission through a console — Google Safe Browsing, via Search Console.

There is no shared standard, no common format, and no central registry. A site with the median 6 listings needs roughly that many separate requests, each in the shape its recipient expects.

The full table — all 35 vendors

Vendor	Share of flagged sites	Sites	Category	Removal channel
AlphaMountain	67%	62	URL reputation	Email
Gridinsoft	53%	49	Antivirus	Email
Fortinet	48%	44	Antivirus	Web form
BitDefender	42%	39	Antivirus	Email
CyRadar	42%	39	Antivirus	Email
Lionic	41%	38	Antivirus	Email
Webroot	40%	37	Antivirus	Web form
Chong Lua Dao	38%	35	URL reputation	Email
G DATA	38%	35	Antivirus	Web form
Sophos	36%	33	Antivirus	Email
ADMINUSLabs	33%	30	URL reputation	Email
CRDF	30%	28	URL reputation	Web form
ESET	30%	28	Antivirus	Email
Forcepoint ThreatSeeker	30%	28	URL reputation	Web form
Vipre	29%	27	Antivirus	Web form
SOCRadar	27%	25	URL reputation	Email
Rising	24%	22	Antivirus	Email
Kaspersky	21%	19	Antivirus	Email
MalwareURL	17%	16	URL reputation	Email
Netcraft	10%	9	URL reputation	Web form
Norton Safe Web	10%	9	URL reputation	Web form
BforeAi	9%	8	URL reputation	Web form
Emsisoft	9%	8	Antivirus	Email
Dr.Web	4%	4	Antivirus	Email
Certego	3%	3	URL reputation	Email
Google Safe Browsing	3%	3	Search engine	Manual console
SafeToOpen	2%	2	URL reputation	Email
Seclookup	2%	2	URL reputation	Email
0xSI_f33d	1%	1	URL reputation	Web form
Cluster25	1%	1	URL reputation	Email
Criminal IP (AI Spera)	1%	1	URL reputation	Email
Fortra (PhishLabs)	1%	1	URL reputation	Email
Hunt.io Intelligence	1%	1	URL reputation	Email
LevelBlue (Trustwave)	1%	1	URL reputation	Web form
Sucuri	1%	1	URL reputation	Email

Vendors below 10% appear on a handful of sites each. They are shown for completeness; treat the tail as indicative rather than statistically meaningful. Google Safe Browsing sits low here by design — it flags far more narrowly than a URL-reputation engine, not because the pipeline missed it.

Take the data

GET https://unflagdomain.com/api/v1/stats

Public, unauthenticated, no key required. Returns the live corpus as JSON — this page shows a frozen edition so cited figures stay put, the API stays current. Free to use and cite; attribution appreciated.

About this data

unflagdomain.com is a paid service (€39 per domain, one-time) that sends removal requests to every vendor flagging a site. This dataset is a by-product of running it. We guarantee dispatch of correctly formatted requests, not delisting — each vendor decides independently and on its own timeline.

We publish the numbers because we would have wanted them before building this.