Classification review

Request a false-positive review

If a clean URL or domain appears incorrectly classified, verify the indicator, complete the remediation checklist and send supporting context to CRDF Labs.

Submit a review Check the URL first

Before requesting a review

Completing these checks gives analysts the context needed to process the request efficiently.

1. Check the classification

Confirm that the exact URL or domain is currently listed. Visit CRDF Threat Center before opening a review.

2. Remediate and gather evidence

Remove suspicious content and record what changed and when: affected URLs, remediation dates, current HTTP responses and relevant ownership or hosting information.

3. Submit once and follow the thread

An active request for the same indicator will not be duplicated. Keep the tracking link and add genuinely new information in its discussion thread.

What happens after submission?

Processing Time: Most requests receive an initial assessment within 24 to 48 hours.
Submission Requirements: Ensure all information is accurate. Existing active requests are detected and will not be duplicated.
Response Notifications: You will receive updates directly to the email address you provide in the form. Keep any reference numbers for future correspondence.

False-positive review form

Submit the exact indicator, a reachable email address and a concise explanation of what is incorrect or what has changed. After submission, use the case thread for every follow-up.

1. Indicator 2. Current evidence 3. Track in the thread

Email address

We'll use this email to send you updates about your request.

Please provide a valid email address.

Submit multiple URLs Check this box if you want to submit multiple false positive requests at once (one URL per line).

Domain Name or Website URL

Please enter an HTTP or HTTPS URL. To indicate an IP address, use a format like "http://255.255.255.255". Check this indicator first.

Please provide a valid URL.

Reason for Your Request

Required. State what is incorrect or what changed, and include dates or affected URLs when relevant.

0/1000

Please provide a valid reason for your request.

Privacy notice. The CRDF Labs operator identified in the Legal Notice processes your e-mail, disputed URLs, explanation, evidence, verification and security metadata to review and document the classification, based on legitimate interests in security operations, data quality, abuse prevention and legal defence. Authorised staff and the providers or security recipients needed for reputation refresh, ownership verification or remediation may receive minimized data. The file is retained for up to 1 year after closure or the last significant activity. See the Privacy Policy and exercise your rights through the GDPR form.

I confirm that the information is accurate, that I am authorised to request this review, and that I accept the review-submission rules in the Terms of Service. I have read the separate privacy notice above. Please ensure your website is clean and compliant before submitting.

You must accept the terms and conditions to continue.

I am not a robot

Most requests receive an initial assessment within 24 to 48 hours.