Manage Blacklisted Domains

Domains used in phishing simulations are evaluated using the same security mechanisms and algorithms as any other domain to determine their legitimacy. Consequently, there isn't a singular reason a domain might be blacklisted. However, adhering to best practices can significantly reduce the risk of a domain being blacklisted.

Why was my domain blacklisted?

In the context of phishing simulations using Lucy, domains can be blacklisted based on several factors. Each security vendor uses different detection mechanisms to identify malicious domains. Here are some key factors:

1. Spoofed Brands:

   • Domains mimicking well-known brands (e.g., Google, Facebook, Microsoft) can be flagged. For example, Google’s algorithms detect visual and structural similarities to known brands to prevent phishing.

2. Phishing Indicators:

   • If the domain hosts landing pages that solicit login credentials, personal information, or payment details, it can be flagged as a phishing site.

3. New or Untrusted Domains:

   • Newly registered domains often lack a reputation. If these domains are used for phishing simulations, they are more likely to be blacklisted.

4. Domain Configuration:

   • The setup of SPF, MX, and A records pointing to the Lucy server is scrutinized. Misconfigurations or anomalies in these records can trigger blacklisting. Checks are done for alignment with typical usage patterns and legitimate email configurations.

5. SSL Certificates:

   • Even with valid SSL certificates, if the domain shows signs of misuse or if the certificates are not from well-known Certificate Authorities, the domain can be flagged.

6. Malware Distribution:

   • If the domain inadvertently hosts or distributes malware (e.g., through attachments or linked downloads), it will be blacklisted. Landing pages can be scanned for malicious software and scripts.

7. Deceptive Content:

   • Inspecting content that is intentionally deceptive or misleading, designed to trick users into performing unsafe actions. This includes fake warnings, alerts, and instructions.

8. Suspicious Behavior Patterns:

   • High volumes of emails sent from the domain, especially those resembling phishing emails, can raise red flags. Monitoring is done for sending patterns and email content for suspicious activities.

9. User Reports:

   • If users report the domain as suspicious or harmful, Google/Microsoft will take these reports into consideration. High numbers of user complaints can lead to a domain being blacklisted.

10. Embedded Links and Redirects:

    • Checks are implemented for suspicious links and redirects within the domain. If the site redirects to known malicious or phishing sites, it can be flagged.

What can I do to prevent Blacklisting?

To minimize the risk of your newly spoofed domains being blacklisted when conducting phishing simulations with content related to known brands like Google, Facebook, and Microsoft, follow these best practices:

Choose Reputable Domain Providers:

• Register your domains with well-known and reputable domain providers. This helps establish initial trust. You can use the built-in Domain wizard for registration with GoDaddy.

Set Up Proper DNS Records:

• Ensure your SPF, DKIM, and DMARC records are correctly configured to authenticate your emails.

• Example SPF record:

  v=spf1 ip4:{your_lucy_ip_address} ~all

• Example DKIM record:

  default._domainkey IN TXT "v=DKIM1; k=rsa; p=<public_key>"

• Example DMARC record:

  _dmarc IN TXT "v=DMARC1; p=none; rua=mailto:[e-mail]"

See our platform reference article on DNS records

Implement HTTPS:

• Use SSL/TLS certificates from reputable Certificate Authorities (CAs) to secure your domains. Use the built-in Let's Encrypt certificate generator for your domains.

Regularly Update Your DNS Records:

• Keep your DNS records up-to-date and ensure there are no misconfigurations.

Content and Email Practices:

Avoid Exact Brand Imitation:

• Avoid replicating the exact appearance of well-known brands like Google, Facebook, or Microsoft. Introduce subtle changes to the email and landing pages to prevent detection by algorithms.

Use Clear Disclaimers:

• Include disclaimers in your emails and landing pages stating that they are part of a security awareness program.

Limit Email Volume:

• Send your phishing simulation emails in small batches to avoid triggering spam filters. Use the built-in Scheduler to achieve this.

Monitor Email Content:

• Ensure your emails do not contain elements commonly associated with spam or phishing, such as excessive links or suspicious attachments.

Test Content with Spam Checkers:

• Use tools like Mail-Tester or Litmus to test your emails for spammy elements before sending them out.

Domain Management and Monitoring:

Warm-Up Your Domain:

• Gradually increase your email sending volume to establish a good sending reputation. Use the built-in Scheduler to achieve this.

Monitor Domain Health:

• Use tools like Google Search Console to monitor your domain’s health and address any issues promptly.

Engage in Regular Clean-Up:

• Periodically review and clean your email lists to ensure you are sending to valid addresses. Use Lucy's built-in automation to automatically keep your users up to date with your organization's directory.

Google Safe Browsing and User Reports:

Regularly Check for Blacklisting:

• Periodically check your domains using tools like Google Safe Browsing to ensure they are not blacklisted.

Promptly Address User Reports:

• Respond quickly to any user reports of suspicious activity related to your domains.

Verify and Whitelist Your Domain:

• Verify your domain ownership with Google Search Console and request reviews if blacklisting occurs.

Legal and Ethical Considerations:

Stay Within Legal Boundaries:

• Ensure your simulations comply with local laws and regulations regarding email communications and data privacy.

Communicate with Stakeholders:

• Inform relevant stakeholders within your organization about the phishing simulations to avoid misunderstandings and false reports to Google.

---

Identify Vendors That Have Blacklisted Your Domain

You can use common tools like:

MXToolbox -> https://mxtoolbox.com/blacklists.aspx

Google SafeBrowsing -> https://www.google.com/webmasters/tools/security-issues

Virus Total -> https://www.virustotal.com/gui/home/url

• Enter your blacklisted domain

• Make a note of all blacklisted vendors

If your domain is displaying "Deceptive Site Ahead" in Chrome, see our guide on Google SafeBrowsing

---

Delisting a Blacklisted Domain

Most vendors allow you to submit a false positive claim to remove a blacklisted domain. Each vendor has specific procedures for this. Below is a list of vendors and their respective whitelisting processes:

Our Technical Support team is available to assist you with de-listing your domain.

Vendor	Contact Email	False Positive Reporting
360	[e-mail]	N/A
Abusix	[e-mail]	Abusix Lookup
Acronis	[e-mail]	N/A
ADMINUSLabs	[e-mail], [e-mail], [e-mail]	N/A
AegisLab	[e-mail]	N/A
Ahnlab	[e-mail], [e-mail]	N/A
AILabs (Monitorapp)	[e-mail]	N/A
Alibaba	[e-mail]	N/A
AliCloud	[e-mail]	N/A
AlienVault	[e-mail]	N/A
AlphaMountain	[e-mail]	N/A
AlphaSOC	[e-mail]	N/A
Alyac (Estsoft)	[e-mail]	N/A
Antivir (Avira)	N/A	Avira Submit URL
Antiy	[e-mail]	N/A
Arcabit	[e-mail]	N/A
ArcSight Threat Intelligence	[e-mail]	N/A
AutoShun	[e-mail]	N/A
Avast	[e-mail]	N/A
AVG	N/A	AVG Submit Sample, AVG Whitelist
Baidu	[e-mail], [e-mail]	N/A
BitDefender	[e-mail]	N/A
BforeAi	N/A	BforeAi Support
Bkav	[e-mail], [e-mail]	N/A
Certego	N/A	Certego Contact
Chong Lua Dao	[e-mail]	N/A
CINS Army (Sentinel IPS)	[e-mail]	CINS Army Contact
ClamAV	N/A	ClamAV Reports
Clean-MX	[e-mail]	N/A
Cluster25	[e-mail]	N/A
CMC	[e-mail]	N/A
CRDF	N/A	CRDF False Positive
Criminal IP (AI Spera)	[e-mail]	N/A
CrowdStrike	[e-mail]	N/A
CSIS Security Group	[e-mail]	N/A
CyanSecurity	[e-mail]	N/A
Cybereason	[e-mail]	N/A
Cyble	[e-mail]	N/A
Cylance	[e-mail]	N/A
Cynet	[e-mail]	N/A
CyRadar	[e-mail]	N/A
Deep Instinct	[e-mail]	N/A
DNS8	[e-mail]	N/A
DrWeb	[e-mail]	N/A
eGambit (Tehtris)	[e-mail]	Tehtris eGambit FP
Elastic	[e-mail]	Elastic Discuss
Emsisoft	[e-mail], [e-mail]	Emsisoft Contact
ESET	N/A	ESET Support
FireEye	[e-mail]	N/A
F-Prot	[e-mail]	N/A
F-Secure/WithSecure	[e-mail], [e-mail]	N/A
Forcepoint ThreatSeeker	[e-mail]	N/A
Fortinet	Fortinet Contact Support	Fortinet Classification Dispute
GData	N/A	GData Submit Suspicious File
Google (File Scanner)	[e-mail]	N/A
Google Safe Browsing (URL/Netloc Scanner)	N/A	Google Safe Browsing Report
GreenSnow	N/A	GreenSnow Contact
Gridinsoft	[e-mail]	N/A
Hacksoft	[e-mail]	N/A
Hauri	[e-mail]	N/A
Heimdal	[e-mail]	N/A
Hunt.io Intelligence	[e-mail]	N/A
Hoplite Industries	[e-mail]	N/A
Ikarus	[e-mail]	N/A
IPsum	N/A	IPsum GitHub
Jiangmin	[e-mail], [e-mail]	N/A
K7	[e-mail], [e-mail]	N/A
Kaspersky	[e-mail]	N/A
Kingsoft	[e-mail]	N/A
Lionic	[e-mail]	Lionic Report FP
Lumu	[e-mail]	N/A
Malbeacon	[e-mail]	N/A
Malwarebytes	N/A	Malwarebytes False Positives
Malwares.com (Saint Security)	[e-mail]	N/A
MalwareURL	[e-mail]	N/A
MAX (SaintSecurity)	[e-mail]	N/A
MaxSecure	[e-mail]	N/A
McAfee	[e-mail]	N/A
Skyhigh	[e-mail]	N/A
Microsoft	N/A	sender.office.com
Microworld	[e-mail]	N/A
NANO	[e-mail]	N/A
Netcraft	N/A	Netcraft Report Mistake
Inca (previous nProtect)	[e-mail]	N/A
Palo Alto	[e-mail]	N/A
Panda	[e-mail], [e-mail]	N/A
Phishing Database	N/A	Phishing Database GitHub
PhishLabs	[e-mail]	N/A
Qihoo360	[e-mail]	N/A
QuickHeal	[e-mail]	N/A
Quttera	[e-mail]	N/A
Rising	N/A	Rising File Check
Sansec eComscan	[e-mail]	N/A
Sangfor	[e-mail]	N/A
Scumware.org	N/A	Scumware Removals
SecureAge	N/A	SecureAge Report FP
Seclookup	[e-mail]	N/A
Segasec	[e-mail]	N/A
Sentinel One	[e-mail]	N/A
SOCRadar	[e-mail]	N/A
Sophos	[e-mail]	Sophos Support
Spamhaus	N/A	Spamhaus DBL Removal
Sucuri	[e-mail]	N/A
Symantec	N/A	Symantec Submit FP, Symantec Content Submission
Tencent	[e-mail]	N/A
TheHacker	[e-mail], [e-mail]	N/A
Trapmine	[e-mail]	N/A
TrendMicro	[e-mail], [e-mail]	TrendMicro Detection Re-evaluation
Trustwave	N/A	Trustwave Detection Review
Trustlook	[e-mail]	N/A
Underworld	[e-mail]	N/A
URLQuery	[e-mail]	N/A
Varist	[e-mail], [e-mail]	N/A
VBA32	[e-mail]	N/A
Viettel Threat Intelligence	[e-mail]	N/A
Vipre	[e-mail]	N/A
VirIT	[e-mail]	N/A
VirusDie	[e-mail]	N/A
Webroot	N/A	Webroot Vendor Dispute
WithSecure/F-Secure	[e-mail], [e-mail]	N/A
Xcitium Verdict Cloud (Comodo)	[e-mail]	N/A
Yomi	[e-mail]	N/A
Yandex	[e-mail]	N/A
Yandex Safebrowsing	[e-mail]	N/A
Zillya	[e-mail]	N/A
ZoneAlarm	[e-mail]	N/A
Zoner	[e-mail]	N/A