Trend Micro False Positive: How to Get a Website Reclassified
To clear a Trend Micro false positive on a website, check the URL in the Trend Micro Site Safety Center, click Reclassify Request, and choose Proceed to URL Reclassification Request as a site owner. Choose the Safe rating, optionally suggest a category, add a comment and your email, then click the validation link Trend Micro emails you. Business customers file through the Business Support Portal instead.
| Vendor | Trend Micro |
|---|---|
| Channel | Web form (owner submits; we prepare the text) |
| Where | Trend Micro Site Safety Center → Check Now → Reclassify Request |
| Account needed | None for site owners and home users; Medium Business and Enterprise customers file a case in the Business Support Portal |
| Vendor states | No stated turnaround. Trend Micro's knowledge base says to wait for a response from its Web Reputation Services team after validating the request. |
| What we have seen | Not measured per vendor yet. In our most recent measured dispatch, all 12 flagging vendors had cleared within 15 days. |
What a Trend Micro flag looks like
Visitors using Trend Micro security software or a Trend Micro-protected network see a block page naming Trend Micro and the site's rating. The Site Safety Center shows the same rating for the URL: Dangerous (malicious software or phishing), Suspicious (compromised before, or associated with spam email) or Untested.
Why clean sites end up flagged here
- The site was compromised before and still carries a 'Suspicious' history even after cleanup.
- The domain appeared in spam email, including spam that forged links to it.
- Trend Micro's scores weigh domain age, hosting history and recent changes, so a new domain or a move to new hosting can lower the score.
- Behaviour analysis found malware or phishing on a page that has since been removed.
Where to submit: Trend Micro Site Safety Center → Check Now → Reclassify Request
https://global.sitesafety.trendmicro.com/
Account: None for site owners and home users; Medium Business and Enterprise customers file a case in the Business Support Portal.
What it asks for:
- Safety rating you believe is correct (Safe or Dangerous)
- Website category (optional: Suggest a different category)
- Introduce yourself: 'I own the website' and/or 'I am a Trend Micro customer'
- Comments (customers add their subscription serial number)
- Email address and the verification words
The request is not processed until you click the validation link Trend Micro sends to the address you entered. Check spam folders.
Step by step
- Check the current rating. Enter the exact URL in the Trend Micro Site Safety Center and click Check Now. Note the safety rating and the category.
- Confirm the site is clean. If the rating is Dangerous, find and remove whatever could explain it (injected scripts, a redirect, a phishing page) and check from outside your network. If it is Suspicious, write down when the old compromise or spam was dealt with.
- Open the reclassify request. Click Reclassify Request, then Proceed to URL Reclassification Request (site owners and home users). Business and Enterprise customers use Proceed to Business Support Portal and open a URL Reclassification case.
- Fill the form. Choose Safe as the rating, suggest a different category only if the current one is wrong, tick 'I own the website', write the evidence in the comments, then enter your email and the verification words.
- Validate and wait. Click the validation link in the email Trend Micro sends; the request is not processed without it. Then wait for the Web Reputation Services team, and re-check the URL in the Site Safety Center.
What to write
Short, specific, impersonal. What was found, what was removed, when, and how it was verified. No marketing language, no attachments, no threats.
URL: {URL}
Current rating: {Dangerous / Suspicious} ({category}).
The site is {one-line description of what the site is}. {Either: 'The content that caused the rating ({what}) was removed on {date}; the URL now returns {404 / the clean page}.' Or: 'The site has not hosted malware or phishing and has not sent spam; it can be verified from any network.'}
Please reclassify the URL as Safe.Why requests get rejected, and the fix
- The validation link was never clicked, so the request was not processed. Look for the email (including the spam folder) and click the link. If it never arrived, submit again with a working address.
- The re-test found malware, phishing or a redirect still on the site. Remove it everywhere it appears, including subdomains and user-agent-specific variants, and file again with the date it was removed.
- The comment gave no evidence, so the reviewer had nothing to weigh against the site's history. State what the site is, what happened, when it was fixed, and what now prevents it happening again.
Who copies this verdict
- Trend Micro business products (Apex One, Worry-Free Business Security, InterScan, ScanMail, Trend Micro Email Security) use the same web reputation ratings.
Sources
Check the URL in the Trend Micro Site Safety Center, click Reclassify Request and choose Proceed to URL Reclassification Request. Choose Safe, tick that you own the website, explain in the comments what the site is and what was fixed, enter your email, and click the validation link Trend Micro sends.
Per the Site Safety Center, Dangerous means the latest tests found malicious software or phishing on the URL. Suspicious means the URL was compromised before or is associated with spam email. Untested means Trend Micro has not checked it yet. A Suspicious rating can stay after cleanup until someone requests a reclassification.
No. Site owners and home users use the public URL Reclassification Request form, which needs only an email address and the verification words. Medium Business and Enterprise customers are directed to open a URL Reclassification case in the Trend Micro Business Support Portal instead.
Trend Micro states no turnaround. Its knowledge base says only to wait for a response from the Web Reputation Services team once the request is validated. Nothing happens until you click the validation link in the confirmation email, so check that first if the rating has not changed.
Trend Micro takes reclassification through its Site Safety Center form, which needs your own email validation, so it is not emailed. When Trend Micro flags your domain, your dashboard shows a prepared card with the link and the text to paste. We guarantee the email requests are sent; each vendor decides its own outcome.