Sources, Coverage & Editorial Methodology

Every entry has a source. Every unknown stays visible. This is a dated research snapshot, not a live list of the engines in your individual scan.

What the directory covers

We cross-reference VirusTotal’s contributor page, file-engine prefixes, network-engine prefixes, and false-positive contact table. File scanners and website / domain scanners are the core scope. Sandbox providers and crowdsourced detection-rule projects are also included in their own categories.

Entries are grouped by the responsible vendor where the official evidence supports that relationship. Separate reporting teams, such as Google File Scanner and Google Safe Browsing, remain separate. Counts describe directory entries, not a guaranteed number of simultaneously active engines. Category counts overlap.

Historical names can remain in API prefix lists or contact tables after a product changes. We retain these search aliases and mark legacy or uncertain records. A listing is not proof that an engine is currently active. File-characterization utilities and artwork credits are outside the appeal directory.

What our evidence labels mean

Label	What we actually checked
Vendor guidance checked	A public vendor or project source supports at least one route or process on the page. Check each contact’s source for its individual evidence level.
Source-listed contact	The route appears in VirusTotal’s official contact list or another cited official source. We have not verified that submissions reach a reviewer.
Public route unconfirmed	No sufficiently supported appeal or general contact route was found. A contributor homepage may be provided only as a research starting point.

Research snapshot: 14 October 2026. “Reviewed” describes source research, not an email delivery test, a completed appeal, or a vendor endorsement. Forms may require an account, CAPTCHA, ownership evidence, or a customer relationship. Read the scope and limitations on each page.

Known coverage gaps

6 entries currently have no confirmed public contact or project route. They remain in the directory so a failed search is not mistaken for complete coverage. No email addresses are guessed.

Babable — public contact unresolved
cyber adAPT — public contact unresolved
Malsilo — public contact unresolved
VX Vault — public contact unresolved
Web Security Guard — public contact unresolved
WhiteArmor — public contact unresolved

Historical and limited-evidence entries

36 entries are marked retired, prefix-only, or contact-only. “Prefix-only” means the name appears in an API engine list but was not matched to a current contributor entry; “contact-only” means it appears only in the official contact table. These labels do not establish current activity.

Show these entries

AegisLab — prefix-only
APEX — prefix-only
AutoShun — retired
AVware — prefix-only
Babable — prefix-only
Commtouch — prefix-only
CrowdSec — prefix-only
Cylance — prefix-only
Cyren — prefix-only
Endgame — prefix-only
Ermes — prefix-only
F-Prot — prefix-only
GreenSnow — prefix-only
Guardpot — contact-only
Invincea — prefix-only
Malbeacon — contact-only
Malware Domain Blocklist — retired
MalwareURL — contact-only
MAX — prefix-only
McAfee Gateway Edition — prefix-only
Mimecast — contact-only
Prevx — prefix-only
Qihoo 360 — prefix-only
SecLookup — prefix-only
Securolytics — prefix-only
Segasec — prefix-only
Snort IP Sample List — prefix-only
StopForumSpam — prefix-only
Sunbelt — prefix-only
TheHacker / Hacksoft — prefix-only
Total Defense — prefix-only
URLhaus — prefix-only
ViriBack — prefix-only
WhiteArmor — prefix-only
WithSecure — contact-only
ZeroCERT — prefix-only

Primary roster sources

Individual vendor pages link the supporting vendor documentation. You can also inspect the directory dataset (JSON) and the source-to-entry coverage map (JSON).

Independence and corrections

False Positive Desk is an independent editorial directory. It is not operated by VirusTotal or any listed vendor. We cannot change a security verdict, guarantee delisting, or accept appeals on behalf of a vendor. Vendor names identify the companies and products concerned.