alphaMountain.ai False Positive: How to Get a Domain Reclassified

What a alphaMountain flag looks like

alphaMountain shows no page of its own to visitors. The verdict appears as a category and threat rating inside products that use its feed (secure gateways, DNS filters, secure browsers), where the site is blocked or warned about, and as an alphaMountain.ai verdict on VirusTotal. Its free lookup, threatYeti, shows a threat score from 1 (safe) to 10 (malicious) and the categories.

Why clean sites end up flagged here

• Detected security vulnerabilities on the site, which alphaMountain's help lists as a reason for a malicious rating.
• Suspicious hosting infrastructure, which alphaMountain's help lists as a reason for a malicious rating.
• Content patterns consistent with phishing or malware distribution, including a hack that has since been cleaned.
• A new or parked domain: alphaMountain has categories for Newly Registered (registered in the last 90 days) and Parked Site, and such domains are often treated with suspicion by the products that use the feed.

Where to submit: alphaMountain Report a False Positive → support portal ticket

https://www.alphamountain.ai/false-positive/

Account: Free account on alphaMountain's support portal (full name and email, or Google sign-in).

What it asks for:

1. The ticket form fields are only visible after logging in to the support portal.
2. What the vendor's help article asks the request to contain: the URL(s) or domains
3. Company details: organisation name and official contact information
4. Context: why the classification is wrong
5. Verification: name and contact details of a company officer

The Report a False Positive page links to a ticket form at alphamountain.freshdesk.com/support/tickets/new, which asks you to sign in or sign up first. We list only what the vendor's help article says to include, because the ticket fields themselves are not public.

Step by step

1. Look the domain up in threatYeti. Enter the domain at threatyeti.com (free; a guest gets 5 queries per day). Note the threat score and the categories. This is the verdict you are disputing, and the screenshot to compare against later.
2. Remove the cause first. If the rating came from a vulnerability or injected content, patch the server and remove it before filing. alphaMountain's help gives a patched server with the malware removed, or a legitimate customer portal, as examples of context for an appeal.
3. Create the support-portal account. Open the Report a False Positive page and follow its form link. The ticket form needs a free account on alphaMountain's support portal. Sign-up asks for a full name and an email, or you can continue with Google.
4. File one ticket with the evidence. Include the domains, the organisation name and official contact information, why the classification is wrong, and the name and contact details of a company officer. Requests are processed in the order they are received.
5. Reanalyze on VirusTotal. alphaMountain says a reclassification typically takes up to 24 hours to propagate. If VirusTotal still shows the old verdict afterwards, click Reanalyze there for every variant: example.com, www.example.com, and the http and https forms of both.

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

Domain(s): {domain, and any other domains or URLs affected}
Organisation: {company name}
Official contact: {company contact information}
Company officer: {company officer name and role}, {officer contact details}
Current classification: {category and threat score shown in threatYeti}.
Why it is wrong: {Either: 'The server was patched and the {malware / injected content} removed on {date}.' Or: 'The site is {one-line description, e.g. a customer portal for our clients}; it has not hosted malware or phishing.'}
Please reclassify the domain.

Why requests get rejected, and the fix

• The request lacked the verification the help article asks for: no organisation details or no company officer's name and contact. Add the organisation name, official contact information and a company officer's details, then file again. This is derived from what the help article asks for; alphaMountain does not publish rejection reasons.
• The cause is still present: the vulnerability is unpatched or the phishing or malware content has not been removed. Patch and clean the site, check every path and subdomain, and state in the new request what was fixed and when. This is our reading, not a vendor-stated rule.

Who copies this verdict

• Secure gateways, DNS providers and secure browsers that license the alphaMountain feed, per its URL classification page.
• VirusTotal, Cisco XDR, Splunk, ReversingLabs, Fortinet FortiSOAR and Sumo Logic are listed on alphaMountain's partners page.

Sources

• alphaMountain.ai — Report a False Positive
• alphaMountain support — What information should I include in a reclassification appeal?
• alphaMountain support — Why was my website classified as malicious?
• alphaMountain support — How long does it take for a reclassified website to reflect across all systems?
• alphaMountain.ai — URL classification
• alphaMountain.ai — Categories
• alphaMountain.ai — Partners
• threatYeti — alphaMountain's free lookup