AlienVault flagged my website — how removal works
CATALOG ENTRY VERIFIED 2026-09-21
AlienVault is a reputation or threat-intelligence feed consumed by firewalls, CDNs, DNS filters, mail gateways and security plugins. It rarely shows a browser warning itself; the block appears downstream, often on a company network. It accepts website false-positive reports by email request. unflagdomain sends that request for you as part of a €39 dispatch; AlienVault reviews the site itself and decides on its own schedule.
| List type | web blocklist |
|---|---|
| Channel | Email request |
| What unflagdomain does | Sends the request for you |
| Step-by-step guide | Not yet — the general process below applies |
| Longer read | — |
What AlienVault is
AlienVault OTX (now LevelBlue) is an open threat-exchange where community pulses list indicators; a domain in a pulse appears as an AlienVault verdict on VirusTotal.
What a AlienVault flag looks like
Visitors on a network or device that consumes this feed cannot reach the site, or see a block page naming the product that consumed it. On VirusTotal and free checkers, a line under this vendor's name.
Why clean sites end up flagged here
- A URL on the domain was seen distributing malware or hosting a phishing page, and the feed keeps the entry until its next crawl finds it gone.
- A single automated sighting — one crawler, one sample — with no human review.
- Shared infrastructure: the same IP, certificate or hosting neighbourhood as something that was flagged.
- A new or parked domain with no history to rate.
How a removal request reaches AlienVault
This vendor accepts a website false-positive report by email at an address it publishes in its own documentation. The message must be plain text, come from an address at the affected domain or a contact the vendor can verify, and state the URL, what was found, what was removed and when.
The general procedure — clean, verify from outside, one specific request, wait for the re-check — is in the complete removal guide, with the checklist of what every request must contain.
What unflagdomain does for this vendor
When a scan shows this vendor flagging your domain, a separately written plain-text request goes out to it in the dispatch, with your address as Reply-To, so the vendor's answer lands in your inbox. If the address bounces, another working contact is looked for and the request re-sent.
This is one of 133 vendors in the catalog. A scan shows which of them flag a domain right now; the €39 dispatch covers every one that does.
AlienVault is a reputation or threat-intelligence feed consumed by firewalls, CDNs, DNS filters, mail gateways and security plugins. It rarely shows a browser warning itself; the block appears downstream, often on a company network. A URL on the domain was seen distributing malware or hosting a phishing page, and the feed keeps the entry until its next crawl finds it gone. A single automated sighting — one crawler, one sample — with no human review.
Clean the site first and verify it from outside. Then this vendor accepts a website false-positive report by email at an address it publishes in its own documentation. The message must be plain text, come from an address at the affected domain or a contact the vendor can verify, and state the URL, what was found, what was removed and when. State the URL, what was found, what was removed and when, in plain text.
AlienVault states no turnaround we can quote. Across our dispatches, vendors of this type mostly answer within a week when they answer at all; some clear silently on their next crawl. In our most recent measured dispatch, 12 of 12 flagging vendors had cleared within 15 days.
When a scan shows this vendor flagging your domain, a separately written plain-text request goes out to it in the dispatch, with your address as Reply-To, so the vendor's answer lands in your inbox. If the address bounces, another working contact is looked for and the request re-sent. We guarantee the request is sent or prepared; AlienVault decides the outcome.