CyRadar False Positive: How to Ask for a Domain Review

What a CyRadar flag looks like

CyRadar is a Vietnamese cyber security company, invested by FPT Ventures. Its Internet Shield DNS product page (in Vietnamese) says it blocks scam, malicious, malware-spreading and C&C domains by resolving them to a sinkhole server. Visitors on a network that uses it would not reach a blocked site (our reading of that page). CyRadar has no public URL checker. Its verdict shows as an engine in VirusTotal's URL scan.

Why clean sites end up flagged here

• CyRadar does not publish why sites get flagged. Its DNS page names the kinds of domain it blocks: scam, malicious, malware-spreading and C&C.
• A past compromise that has been cleaned, but was recorded before the cleanup (our reading; CyRadar does not say this).
• A malicious page on a path or subdomain you do not watch, which can put the whole domain on a list (our reading; CyRadar does not say this).
• A new or little-known domain with few positive signals (our reading; CyRadar does not say this).

Where to submit: CyRadar Report a False Positive → False Positive Report

https://cyradar.com/reportfp/

Account: None (the form has a reCAPTCHA).

What it asks for:

1. Company (*), required
2. Email (*), required
3. Telephone, optional
4. Message, where the domain must go: there is no domain or URL field
5. Send

The fields show placeholders only, not separate labels. The form says: "Contact us if you think your domain name needs reviewing." If you have no company, enter the name of the site or business in Company (our advice).

Step by step

1. Check the verdict on VirusTotal. CyRadar has no public checker. Scan the URL on VirusTotal and note what the CyRadar engine says. That is the verdict you are disputing, and the place to re-check later.
2. Confirm the site is clean. If the site was hacked or hosted something flagged, remove it, and note what was removed and when. Check subdomains and old folders too (our advice).
3. Open the False Positive Report form. No account is needed. Fill in Company and Email, both required. Telephone is optional. If you have no company, enter the name of the site or business (our advice).
4. Put the domain in the Message box. The form has no domain or URL field. This is the main trap: if the Message does not name the domain, CyRadar has nothing to review. Start the message with the domain, then say why it is a false positive.
5. Solve the reCAPTCHA and click Send. CyRadar does not state any confirmation, so note the date you sent it. File once per domain. CyRadar states no rules on repeat requests, but a second copy adds nothing (our reading).
6. Re-scan on VirusTotal. After filing, reanalyze the URL on VirusTotal to see whether the CyRadar verdict changed. CyRadar states no turnaround, so a quick re-scan may show no change.

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

Domain: {domain}
What the site is: {one-line description}.
Current verdict: {what the CyRadar engine shows on VirusTotal}.
Why it is a false positive: {Either: 'The site was cleaned on {date}: {what was removed or secured}.' Or: 'The site has not hosted malware, phishing or scams.'}
Please review the domain.

Why requests get rejected, and the fix

• The message does not name the domain. CyRadar states no rejection reasons; this is our reading of the form, which has no domain field. Start the Message with "Domain: {domain}" on its own line.
• The message gives no reason for the review (our reading; CyRadar states no rules). Say what the site is, and either what was cleaned and when, or that it has not hosted malware, phishing or scams.
• The Company field was left empty, so the form cannot be sent. Company is marked required. If you have no company, enter the site or business name (our advice).

Who copies this verdict

• VirusTotal shows CyRadar's URL verdict as one of its engines.
• CyRadar's DNS page says networks that use Internet Shield DNS filtering resolve blocked domains to a sinkhole server.

Sources

• CyRadar — Report a False Positive
• CyRadar — About
• CyRadar Internet Shield — DNS (Vietnamese)