ESET Blocked My Website: How to Report a False Positive

What a ESET flag looks like

An ESET page in the browser saying the website was blocked — access denied because the page is on ESET's list of websites with potentially dangerous content — or a phishing warning from ESET's anti-phishing module. Visitors running ESET at home or on a company endpoint see it; other visitors see nothing.

Why clean sites end up flagged here

• A past compromise — injected redirect, malicious script or phishing page — that ESET's lab listed and has not re-checked.
• A phishing detection triggered by a login or payment form that resembles another brand.
• A detection on a file the site hosts, which blocks the URL that serves it.
• Parental Control or Web Control miscategorisation — a category block, not a threat detection, reported through a different ESET process.

Where to submit: ESET KB141 — Submit a suspicious website / potential false positive website (email to the ESET Research Lab)

https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab

Account: None.

What it asks for:

1. Subject: 'Domain whitelist' followed by the blocked domain
2. Body: the complete URLs being blocked
3. Body: why you think it is a false positive
4. Recommended: a screenshot of the block notification
5. Format: plain text, no other links, email addresses or images, no footer

The address is documented in KB141. ESET users can also submit from inside the product (Select sample for analysis → False positive site).

Step by step

1. Capture the block. Get a screenshot of the ESET block page and the exact URL it names. Note whether it says potentially dangerous content, phishing, or a category block from Parental or Web Control.
2. Fix or confirm the cause. Remove any injected content, redirect or phishing page and check from an external network. If the site never hosted anything like it, say so plainly in the email.
3. Write the email as ESET specifies. Subject: 'Domain whitelist' and the blocked domain. Body: the complete blocked URLs and why it is a false positive. Plain text, no other links, email addresses or images, and no footer. Attach the screenshot if you have one.
4. Send it to the address in KB141. ESET documents the Research Lab address in KB141. Send one message per domain, listing every blocked URL on that domain.
5. Follow up after three days if urgent. If the issue is not resolved within three days and it is urgent, ESET asks for a follow-up with the original subject line, the date and time it was sent and the sending address.

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

Subject: Domain whitelist {domain}

Blocked URL(s):
{full URL 1}
{full URL 2}

Why this is a false positive: {domain} is a {one-line description of what the site is}. {Either: 'The content that triggered the block ({what}) was removed on {date} and the URL now returns {404 / the clean page}.' Or: 'The site has not hosted malware, phishing or redirects; the page can be checked from any network.'}
Please re-check the domain and remove it from the blocklist.

Why requests get rejected, and the fix

• The message did not follow ESET's format — no 'Domain whitelist' subject, HTML, extra links or a signature footer. Resend as plain text with the required subject, only the blocked URLs, and no footer.
• The lab re-checked and still found the content, on the same or another URL. Search the site for the same pattern, remove it, and report again with the removal date.
• The block is a Parental Control or Web Control category, not a threat detection. Use the miscategorisation process in KB141 for category blocks.

Who copies this verdict

• Products that license ESET's detection technology clear when ESET updates its list.

Sources

• ESET KB141 — Submit a virus, website, or potential false positive sample to the ESET Research Lab
• ESET Online Help — Select sample for analysis: False positive site

Longer read: why ESET flags clean sites and how unflagdomain handles it.