G DATA False Positive: How to Submit a Wrongly Blocked Website for Review

What a G DATA flag looks like

G DATA CyberDefense AG is a security software company in Bochum, Germany. Its help page says that when its software blocks a website as a threat, the visitor gets a G DATA information page in the browser instead of the site, with wording such as "G DATA Web Protection has blocked the access to the requested URL." Web protection comes with G DATA Antivirus, Internet Security and Total Security, and Android Mobile Security. G DATA is also one of the URL engines in VirusTotal's scan.

Why clean sites end up flagged here

• G DATA does not publish why sites get flagged. Its help page says its web protection blocks a site that its software detects as a threat.
• A past compromise that has been cleaned, but was recorded before the cleanup (our reading; G DATA does not say this).
• A malicious page on a path or subdomain you do not watch, which can mark the whole site (our reading; G DATA does not say this).
• A new or little-known domain with few positive signals (our reading; G DATA does not say this).

Where to submit: G DATA Submit a file, app, or URL for review → Submit a URL

https://su.gdatasoftware.com/url-submission

Account: None. G DATA partners can log in for "preferential treatment". The form first asks you to agree to conditions and passes an automatic anti-robot check..

What it asks for:

1. Consent page: checkbox "I expressly agree to these conditions."
2. "Please enter the URL you want to submit." (required, must start with http:// or https://)
3. "Why are you submitting this URL?" (pick "Website has been incorrectly classified as malicious"; "I am not sure" is not accepted)
4. "Where did you find this URL?" (optional)
5. Additional information, all optional: operating system, browser, "Security solution"
6. "Comment – Please describe the reason behind this submission" (optional, max 5000)
7. "G DATA support ticket number" (optional)
8. "Email" (optional; G DATA says to enter it if you want feedback from its support department on the analysis)

The form runs in steps: URL, URL information, Additional information, Summary. We advise entering an email, since it is the only way G DATA offers to send feedback (our advice). The same help page covers files and apps; use the URL route for a website.

Step by step

1. Check the verdict on VirusTotal. We found no public G DATA URL checker. Scan the URL on VirusTotal and note what the G DATA engine says. That is the verdict you are disputing, and the place to re-check later.
2. Confirm the site is clean. If the site was hacked or hosted something flagged, remove it, and note what was removed and when. Check subdomains and old folders too (our advice).
3. Open the URL submission form. On G DATA's help page "Submit a file, app, or URL for review", click "Submit a URL". Tick "I expressly agree to these conditions." and pass the automatic anti-robot check. No account is needed.
4. Fill in the form. Enter the full URL, starting with http:// or https://. For the reason, pick "Website has been incorrectly classified as malicious"; "I am not sure" is not accepted. Write your explanation in the comment, up to 5000 characters. Enter your email if you want feedback.
5. Submit once. The page says: "Thank you for your submission. We will process your request as soon as possible." It shows no ticket number. G DATA states no rules on repeat requests, but a second copy adds nothing (our reading).
6. Re-scan on VirusTotal. After filing, reanalyze the URL on VirusTotal to see whether the G DATA verdict changed. G DATA states no turnaround, so a quick re-scan may show no change.

What to write

Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.

Domain: {domain}
URL: {full URL}
What the site is: {one-line description}.
Current verdict: {what the G DATA engine shows on VirusTotal, or the block page wording}.
Why it is a false positive: {Either: 'The site was cleaned on {date}: {what was removed or secured}.' Or: 'The site has not hosted malware or phishing.'}
Please review the classification.

Why requests get rejected, and the fix

• The form will not accept the reason "I am not sure", or the URL does not start with http:// or https://. Pick "Website has been incorrectly classified as malicious" and enter the full URL with its http:// or https:// start.
• No email was entered, so G DATA has no way to send feedback. The form says the email is for feedback. G DATA publishes no rejection reasons; this is our reading. Enter an email, and say in the comment what the site is and why the verdict is wrong.
• The comment gives nothing to review (our reading; G DATA states no rules). Say either what was cleaned and when, or that the site has not hosted malware or phishing.

Who copies this verdict

• VirusTotal shows G DATA's URL verdict as one of its engines. G DATA's 2010 blog says VirusTotal embeds its URL technology.
• G DATA's own web protection: Antivirus, Internet Security, Total Security, its browser extensions for Firefox, Edge and Chrome, and Android Mobile Security.

Sources

• G DATA — Submit a file, app, or URL for review
• G DATA — URL submission
• G DATA — Web protection (Security Center help)
• G DATA — Internet Security
• G DATA — Imprint