How to appeal a domain or URL blacklist detection

Record exactly what is blocked

Save the full URL, including the scheme and path, the security product’s message, and the VirusTotal report. Note whether the problem affects one page, a subdomain, an IP address, or the whole domain.

A category such as “gambling” is different from a malware verdict. Choose category review for a classification mistake and false-positive review for a disputed threat detection. FortiGuard exposes these as separate workflows.

Check the website before appealing

Review recent site changes, unexpected redirects, injected scripts, unfamiliar downloads, and content served to different devices. If you discover a compromise, fix it and document what changed before requesting another assessment.

When you believe the page was always legitimate, explain its purpose and the context that may have caused confusion. Provide ownership evidence when the vendor asks for it.

Submit the evidence to each detecting vendor

Use the vendor page in this directory to find the URL-specific form or mailbox. Include the affected page, the detection name, the report link, and a short explanation. If a service needs a lookup first, run that lookup and follow its review link.

If several independent vendors flag the address, each may require its own review. A clearance from one vendor does not update every other vendor’s database. Avoid sending identical follow-ups repeatedly; reference the existing case.

Keep a small review log

Record the vendor, submitted URL, submission date, case reference, and response. After a change is confirmed, check the same URL again. A historical threat record can remain visible even when the current site is no longer blocked.