Lionic False Positive: How to Report a Wrong Malicious Website Verdict
To dispute a Lionic false positive, open Lionic's Report False Positive page and keep the default section, False Positive URL on VirusTotal. No account is needed. Enter your email, the site's URL (not a VirusTotal link), a subject and a message, tick the privacy box and submit. Lionic states no turnaround and shows only a thank-you message. Then reanalyze on VirusTotal.
| Vendor | Lionic |
|---|---|
| Channel | Web form (owner submits; we prepare the text) |
| Where | Lionic Report False Positive → False Positive URL on VirusTotal |
| Account needed | None (the form has a reCAPTCHA) |
| Vendor states | No stated turnaround. The page after submitting says to wait for processing and for platforms to update their signatures. Separately, Lionic's Anti-WebThreat page says its local signature set is updated twice a week; it does not say this covers false positive reports. |
| What we have seen | Not enough data yet. |
What a Lionic flag looks like
Lionic Corporation is a network and cybersecurity technology company from Taiwan. Its free checker at check.lionic.com shows an "Anti-WebThreat Result", for example "Malicious Website". Lionic is also one of the URL engines in VirusTotal's scan, which is where most site owners first see it. Lionic's Anti-WebThreat page says the product can block malicious connections across all protocols, and lists ISP gateways, enterprise firewalls, public Wi-Fi and IoT as uses. A separate "Web Content Filtering Result" is the site's category, not a threat verdict.
Why clean sites end up flagged here
- Lionic does not publish why sites get flagged. Its Anti-WebThreat page says the product covers "tens of millions of harmful domains, IPs, and URLs".
- A past compromise that has been cleaned, but was recorded before the cleanup (our reading; Lionic does not say this).
- A malicious page on a path or subdomain you do not watch, which can mark the whole site (our reading; Lionic does not say this).
- A new or little-known domain with few positive signals (our reading; Lionic does not say this).
Where to submit: Lionic Report False Positive → False Positive URL on VirusTotal
https://www.lionic.com/supports/report-false-positive/
Account: None (the form has a reCAPTCHA).
What it asks for:
- Section: a radio list; "False Positive URL on VirusTotal" is the default
- Reporter Name (optional, max 128)
- Reporter Email Address (required)
- False Positive URL (required, must begin with http or https, max 256; the site's URL, not a VirusTotal link)
- Subject (required, max 128)
- Message (required, max 1024)
- Checkbox: "I have read and agree with Lionic's privacy policy"; the buttons stay disabled until it is ticked
- "Submit and Subscribe to Lionic Newsletter" or "Submit Only"
The other sections are False Positive File on VirusTotal, False Positive URL of Lionic Products, False Positive File of Lionic Products and False Positive Intrusion of Lionic Products. The URL of Lionic Products section has the same fields plus an optional Anti-WebThreat Signature ID, and Lionic's own checker links to it. Lionic's notice says: "Note that we have no control over third party platforms like VirusTotal."
Step by step
- Check the result on Lionic's free checker. Enter the URL at check.lionic.com. If the Anti-WebThreat Result says Malicious Website, this guide applies. If only the Web Content Filtering Result is wrong, that is a category problem: use the Reclassify link there, not the false positive form.
- Confirm the site is clean. If the site was hacked or hosted something flagged, remove it, and note what was removed and when (our advice).
- Open the Report False Positive page and pick the section. Keep the default, False Positive URL on VirusTotal, if the verdict you see is on VirusTotal. If you came from Lionic's checker, its link opens the False Positive URL of Lionic Products section, which has the same fields. Which one Lionic prefers for a site is not stated.
- Fill in the fields. Enter your email, then the site's own URL, beginning with http or https and no longer than 256 characters. Do not paste a VirusTotal link. Add a subject and a message of up to 1024 characters. Tick the privacy box, or the buttons stay disabled, then click Submit Only or the newsletter option.
- File once, then wait and re-check. The page says: "After you reported successfully, please wait for the processing and the updating signature of platforms." It mentions no ticket and no email. Re-check at check.lionic.com and reanalyze on VirusTotal. Lionic says it has no control over VirusTotal.
What to write
Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.
Subject: False positive: {domain}
Message: {full URL} is shown as {verdict, e.g. Malicious Website on check.lionic.com}. {Either: 'The site was cleaned on {date}: {what was removed or secured}.' Or: 'The site is {one-line description} and has not hosted malware or phishing.'} Please re-evaluate this URL.Why requests get rejected, and the fix
- The form will not submit because the URL field is wrong. Enter the site's URL, beginning with http or https, at most 256 characters. A VirusTotal link is not what the field asks for.
- The problem is a wrong category, not a threat verdict. Use the Reclassify link on check.lionic.com, which Lionic provides for wrong categories.
- The message gives nothing to review. Lionic states no rejection reasons; this is our reading. Say what the site is, and either what was cleaned and when, or that it has not hosted malware or phishing. Keep it under 1024 characters.
Who copies this verdict
- Lionic's 2023 release says its database is licensed by numerous international network appliance companies, including Cisco and NEC.
- VirusTotal shows Lionic's URL verdict as one of its engines. Lionic's portal has a section for it and says it has no control over VirusTotal.
Sources
Open Lionic's Report False Positive page. It needs no account. Keep the default section, False Positive URL on VirusTotal, enter your email, the site's URL, a subject and a message, tick the privacy box and submit.
Lionic states no turnaround. After you submit, the page says to wait for processing and for platforms to update their signatures. We do not have enough data yet to give an observed time.
The on-screen message is "Thank for your submission." Lionic's page mentions no ticket and no email. Note the date you sent it.
Lionic's checker shows a separate Web Content Filtering Result with a Reclassify link for wrong categories. Use that, not the false positive form.