CRDF False Positive: How to Request a Review of a Listed Domain

What a CRDF flag looks like

CRDF is an independent French cybersecurity laboratory operated from Paris, France. Its labels are Phishing:URL, Malware:URL, Malicious:URL and Suspect:URL, and only an IP, domain or subdomain gets a classification. Its FAQ says CRDF does not operate a public browser-blocking product, and that customers or third-party security services may use its assessments in their own filtering. Its verdict shows as an engine on VirusTotal.

Why clean sites end up flagged here

• CRDF's detection criteria include "Compromised resources": "Legitimate infrastructure altered or misused by another party without necessarily involving the operator's knowledge or intent." Its labels are Phishing:URL, Malware:URL, Malicious:URL and Suspect:URL.
• Under that heading it names phishing pages, malicious scripts or downloads added without the operator's authorisation, a compromised website, hosting account or CMS, unauthorised use of DNS records, subdomains or storage, and injected redirects.
• A past compromise that has been cleaned, but was recorded before the cleanup (our reading; CRDF does not say this).
• A malicious page on a path or subdomain you do not watch. CRDF's criteria cover unauthorised use of subdomains; whether one page can mark the whole domain is our reading.
• A new or little-known domain with few positive signals, which can be rated Suspect:URL (our reading; CRDF does not say this).

Where to submit: CRDF Threat Center → Request a false-positive review

https://threatcenter.crdf.fr/false_positive.html

Account: None (the form has CRDF's own "I am not a robot" check).

What it asks for:

1. "Email address" (required; "We'll use this email to send you updates about your request.")
2. Checkbox "Submit multiple URLs" (one URL per line, "Maximum 5 URLs per submission.")
3. "Domain Name or Website URL" (required; an HTTP or HTTPS URL)
4. "Reason for Your Request" (required, max 1000 characters; "State what is incorrect or what changed, and include dates or affected URLs when relevant.")
5. A required checkbox confirming the information is accurate, that you are authorised, and that you accept the review rules in the Terms of Service
6. CAPTCHA, then "Send Message"

Before filing, the page asks you to confirm "that the exact URL or domain is currently listed" using the public lookup, and to remove suspicious content and record what changed and when. Do not use CRDF's general contact form: its FAQ says disputes sent that way "cannot be processed as reviews".

Step by step

1. Confirm the listing on CRDF's public lookup. Enter the exact URL or domain on the CRDF Threat Center check page and note the label shown. CRDF's form page asks you to confirm that it is currently listed before you file.
2. Clean up and record what changed. The form page asks you to remove suspicious content and record what changed and when. Check subdomains and old folders too (our advice).
3. Open the review form and enter your email. No account is needed. Use a real address: updates go to the email you enter, and CRDF's FAQ says temporary or disposable addresses may be rejected. To submit several URLs, tick "Submit multiple URLs" and put one per line, up to 5.
4. Write the reason. State what is incorrect or what changed, with dates or affected URLs. The limit is 1000 characters. Tick the box confirming the information is accurate and that you are authorised and accept the review rules in the Terms, then pass the CAPTCHA and click Send Message.
5. File once and confirm by email. The FAQ says: "Do not create duplicate requests." It also says to open the secure link in the confirmation email, and to keep any reference numbers. When asked for ownership proof, CRDF says it is commonly a DNS record or an eligible domain email address.
6. Re-check the lookup first. Check the CRDF lookup page first. CRDF's FAQ says VirusTotal can still show CRDF after a clean decision because "Third-party services control their own cache". It also says a CLEAN decision "is not a permanent allowlist".

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

Domain: {domain}
Listed as: {label shown on the CRDF lookup, e.g. Phishing:URL}.
What changed: {Either: 'The site was cleaned on {date}: {what was removed or secured}. Affected URLs: {urls}.' Or: 'The site is {one-line description} and has not hosted malware or phishing.'}
Please review this listing.

Why requests get rejected, and the fix

• The request is incomplete, unverifiable or repeated without new evidence. CRDF's Terms, section 9, say it may reject requests that are "incomplete, unverifiable, abusive, automated, fraudulent, impersonated, repeated without new evidence". Fill in every required field, give dates and affected URLs, and refile only with something new.
• A temporary or disposable email address was used. The FAQ says these may be rejected. Use a real address you read; CRDF sends updates there.
• The dispute was sent through the general contact form. The FAQ says these "cannot be processed as reviews". Use the false-positive review form.
• A duplicate request. The FAQ says: "Do not create duplicate requests." File once per listing and keep any reference numbers CRDF sends.

Who copies this verdict

• VirusTotal shows CRDF's URL verdict as one of its engines.
• CRDF's partners page lists VIPRE, VirusTotal, IKARUS, G DATA, Avast, ReversingLabs, Cloudflare and others as organisations that "collaborate with CRDF Labs, consume CRDF intelligence or support" its operations. It does not say which of them use the verdict.

Sources

• CRDF Threat Center — Request a false-positive review
• CRDF Threat Center — Check a URL or domain
• CRDF Threat Center — FAQ
• CRDF Threat Center — Detection criteria
• CRDF Threat Center — Terms
• CRDF Threat Center — Partners