# Manage Blacklisted Domains
Domains used in phishing simulations are evaluated using the same security mechanisms and algorithms as any other domain to determine their legitimacy. Consequently, there isn't a singular reason a domain might be blacklisted. However, adhering to best practices can significantly reduce the risk of a domain being blacklisted.
Why was my domain blacklisted?
In the context of phishing simulations using Lucy, domains can be blacklisted based on several factors. Each security vendor uses different detection mechanisms to identify malicious domains. Here are some key factors:
1. **Spoofed Brands:**
* Domains mimicking well-known brands (e.g., Google, Facebook, Microsoft) can be flagged. For example, Google’s algorithms detect visual and structural similarities to known brands to prevent phishing.
2. **Phishing Indicators:**
* If the domain hosts landing pages that solicit login credentials, personal information, or payment details, it can be flagged as a phishing site.
3. **New or Untrusted Domains:**
* Newly registered domains often lack a reputation. If these domains are used for phishing simulations, they are more likely to be blacklisted.
4. **Domain Configuration:**
* The setup of SPF, MX, and A records pointing to the Lucy server is scrutinized. Misconfigurations or anomalies in these records can trigger blacklisting. Checks are done for alignment with typical usage patterns and legitimate email configurations.
5. **SSL Certificates:**
* Even with valid SSL certificates, if the domain shows signs of misuse or if the certificates are not from well-known Certificate Authorities, the domain can be flagged.
6. **Malware Distribution:**
* If the domain inadvertently hosts or distributes malware (e.g., through attachments or linked downloads), it will be blacklisted. Landing pages can be scanned for malicious software and scripts.
7. **Deceptive Content:**
* Inspecting content that is intentionally deceptive or misleading, designed to trick users into performing unsafe actions. This includes fake warnings, alerts, and instructions.
8. **Suspicious Behavior Patterns:**
* High volumes of emails sent from the domain, especially those resembling phishing emails, can raise red flags. Monitoring is done for sending patterns and email content for suspicious activities.
9. **User Reports:**
* If users report the domain as suspicious or harmful, Google/Microsoft will take these reports into consideration. High numbers of user complaints can lead to a domain being blacklisted.
10. **Embedded Links and Redirects:**
* Checks are implemented for suspicious links and redirects within the domain. If the site redirects to known malicious or phishing sites, it can be flagged.
What can I do to prevent Blacklisting?
To minimize the risk of your newly spoofed domains being blacklisted when conducting phishing simulations with content related to known brands like Google, Facebook, and Microsoft, follow these best practices:
### **Choose Reputable Domain Providers:**
* Register your domains with well-known and reputable domain providers. This helps establish initial trust. You can use the built-in [Domain wizard](/application-reference/settings/common-system-settings/domains.md#register) for registration with GoDaddy.
### **Set Up Proper DNS Records:**
* Ensure your SPF, DKIM, and DMARC records are correctly configured to authenticate your emails.
* [Example SPF record:](/application-reference/settings/common-system-settings/domains.md#dns-records-explained)
```plaintext
v=spf1 ip4:{your_lucy_ip_address} ~all
```
* [Example DKIM record:](/application-reference/campaigns/campaign-settings/main-settings/attack-simulation.md#dkim-support)
```plaintext
default._domainkey IN TXT "v=DKIM1; k=rsa; p="
```
* Example DMARC record:
```plaintext
_dmarc IN TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com"
```
See our platform reference article on [DNS records](/application-reference/settings/common-system-settings/domains.md#add-a-domain)
### **Implement HTTPS:**
* Use SSL/TLS certificates from reputable Certificate Authorities (CAs) to secure your domains. Use the built-in [Let's Encrypt certificate generator](/application-reference/settings/common-system-settings/ssl-settings.md) for your domains.
### **Regularly Update Your DNS Records:**
* Keep your DNS records up-to-date and ensure there are no misconfigurations.
### **Content and Email Practices:**
**Avoid Exact Brand Imitation:**
* Avoid replicating the exact appearance of well-known brands like Google, Facebook, or Microsoft. Introduce subtle changes to the email and landing pages to prevent detection by algorithms.
**Use Clear Disclaimers:**
* Include disclaimers in your emails and landing pages stating that they are part of a security awareness program.
**Limit Email Volume:**
* Send your phishing simulation emails in small batches to avoid triggering spam filters. Use the built-in [Scheduler](/application-reference/campaigns/campaign-settings/optional-settings/schedule.md) to achieve this.
**Monitor Email Content:**
* Ensure your emails do not contain elements commonly associated with spam or phishing, such as excessive links or suspicious attachments.
**Test Content with Spam Checkers:**
* Use tools like Mail-Tester or Litmus to test your emails for spammy elements before sending them out.
### **Domain Management and Monitoring:**
**Warm-Up Your Domain:**
* Gradually increase your email sending volume to establish a good sending reputation. Use the built-in [Scheduler](/application-reference/campaigns/campaign-settings/optional-settings/schedule.md) to achieve this.
**Monitor Domain Health:**
* Use tools like [Google Search Console ](https://search.google.com/search-console/about)to monitor your domain’s health and address any issues promptly.
**Engage in Regular Clean-Up:**
* Periodically review and clean your email lists to ensure you are sending to valid addresses. Use [Lucy's built-in automation](/application-reference/settings/common-system-settings/ldap-settings.md#action-for-new-users) to automatically keep your users up to date with your organization's directory.
### **Google Safe Browsing and User Reports:**
**Regularly Check for Blacklisting:**
* Periodically check your domains using tools like Google Safe Browsing to ensure they are not blacklisted.
**Promptly Address User Reports:**
* Respond quickly to any user reports of suspicious activity related to your domains.
**Verify and Whitelist Your Domain:**
* Verify your domain ownership with Google Search Console and request reviews if blacklisting occurs.
### **Legal and Ethical Considerations:**
**Stay Within Legal Boundaries:**
* Ensure your simulations comply with local laws and regulations regarding email communications and data privacy.
**Communicate with Stakeholders:**
* Inform relevant stakeholders within your organization about the phishing simulations to avoid misunderstandings and false reports to Google.
***
### Identify Vendors That Have Blacklisted Your Domain
You can use common tools like:
**MXToolbox** ->
**Google SafeBrowsing** ->
**Virus Total** ->
* Enter your blacklisted domain
* Make a note of all blacklisted vendors
{% hint style="info" %}
If your domain is displaying "Deceptive Site Ahead" in Chrome, see our guide on [Google SafeBrowsing](/guides/manage-blacklisted-domains/managing-google-safebrowsing-alerts.md)
{% endhint %}
***
### Delisting a Blacklisted Domain
Most vendors allow you to submit a false positive claim to remove a blacklisted domain. Each vendor has specific procedures for this. Below is a list of vendors and their respective whitelisting processes:
{% hint style="success" %}
Our [Technical Support](/contact-us.md) team is available to assist you with de-listing your domain.
{% endhint %}
| Vendor | Contact Email | False Positive Reporting |
| ----------------------------------------- | -------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 360 | | N/A |
| Abusix | | [Abusix Lookup](https://lookup.abusix.com/) |
| Acronis | | N/A |
| ADMINUSLabs | , , | N/A |
| AegisLab | | N/A |
| Ahnlab | , | N/A |
| AILabs (Monitorapp) | | N/A |
| Alibaba | | N/A |
| AliCloud | | N/A |
| AlienVault | | N/A |
| AlphaMountain | | N/A |
| AlphaSOC | | N/A |
| Alyac (Estsoft) | | N/A |
| Antivir (Avira) | N/A | [Avira Submit URL](https://www.avira.com/en/analysis/submit-url) |
| Antiy | | N/A |
| Arcabit | | N/A |
| ArcSight Threat Intelligence | | N/A |
| AutoShun | | N/A |
| Avast | | N/A |
| AVG | N/A | [AVG Submit Sample](http://www.avg.com/submit-sample), [AVG Whitelist](http://www.avg.com/us-en/whitelist) |
| Baidu | , | N/A |
| BitDefender | | N/A |
| BforeAi | N/A | [BforeAi Support](https://bfore.ai/support) |
| Bkav | , | N/A |
| Certego | N/A | [Certego Contact](https://www.certego.net/company/contact-us/) |
| Chong Lua Dao | | N/A |
| CINS Army (Sentinel IPS) | | [CINS Army Contact](http://cinsscore.com/#contact) |
| ClamAV | N/A | [ClamAV Reports](http://www.clamav.net/reports/fp) |
| Clean-MX | | N/A |
| Cluster25 | | N/A |
| CMC | | N/A |
| CRDF | N/A | [CRDF False Positive](https://threatcenter.crdf.fr/false_positive.html) |
| Criminal IP (AI Spera) | | N/A |
| CrowdStrike | | N/A |
| CSIS Security Group | | N/A |
| CyanSecurity | | N/A |
| Cybereason | | N/A |
| Cyble | | N/A |
| Cylance | | N/A |
| Cynet | | N/A |
| CyRadar | | N/A |
| Deep Instinct | | N/A |
| DNS8 | | N/A |
| DrWeb | | N/A |
| eGambit (Tehtris) | | [Tehtris eGambit FP](https://tehtris.com/en/forms/false-positives-false-negatives/) |
| Elastic | | [Elastic Discuss](https://discuss.elastic.co/t/submitting-false-positives/232322) |
| Emsisoft | , | [Emsisoft Contact](https://www.emsisoft.com/en/help/1720/why-did-an-emsisoft-product-detect-an-innocent-file-as-malware-2/) |
| ESET | N/A | [ESET Support](https://support.eset.com/kb141/?page=content\&id=SOLN141) |
| FireEye | | N/A |
| F-Prot | | N/A |
| F-Secure/WithSecure | , | N/A |
| Forcepoint ThreatSeeker | | N/A |
| Fortinet | [Fortinet Contact Support](http://www.fortinet.com/support/contact_support.html) | [Fortinet Classification Dispute](https://www.fortiguard.com/faq/classificationdispute) |
| GData | N/A | [GData Submit Suspicious File](https://www.gdatasoftware.com/faq/consumer/submit-a-suspicious-file-app-or-url) |
| Google (File Scanner) | | N/A |
| Google Safe Browsing (URL/Netloc Scanner) | N/A | [Google Safe Browsing Report](https://safebrowsing.google.com/safebrowsing/report_error/?hl=en) |
| GreenSnow | N/A | [GreenSnow Contact](https://greensnow.co/contact) |
| Gridinsoft | | N/A |
| Hacksoft | | N/A |
| Hauri | | N/A |
| Heimdal | | N/A |
| Hunt.io Intelligence | | N/A |
| Hoplite Industries | | N/A |
| Ikarus | | N/A |
| IPsum | N/A | [IPsum GitHub](https://github.com/stamparm/ipsum) |
| Jiangmin | , | N/A |
| K7 | , | N/A |
| Kaspersky | | N/A |
| Kingsoft | | N/A |
| Lionic | | [Lionic Report FP](https://www.lionic.com/reportfp/) |
| Lumu | | N/A |
| Malbeacon | | N/A |
| Malwarebytes | N/A | [Malwarebytes False Positives](https://forums.malwarebytes.com/forum/122-false-positives/) |
| Malwares.com (Saint Security) | | N/A |
| MalwareURL | | N/A |
| MAX (SaintSecurity) | | N/A |
| MaxSecure | | N/A |
| McAfee | | N/A |
| Skyhigh | | N/A |
| Microsoft | N/A | [sender.office.com](https://sender.office.com/) |
| Microworld | | N/A |
| NANO | | N/A |
| Netcraft | N/A | [Netcraft Report Mistake](https://report.netcraft.com/report/mistake) |
| Inca (previous nProtect) | | N/A |
| Palo Alto | | N/A |
| Panda | , | N/A |
| Phishing Database | N/A | [Phishing Database GitHub](https://github.com/mitchellkrogza/Phishing.Database#please-remove-my-domain-from-this-list-) |
| PhishLabs | | N/A |
| Qihoo360 | | N/A |
| QuickHeal | | N/A |
| Quttera | | N/A |
| Rising | N/A | [Rising File Check](http://mailcenter.rising.com.cn/filecheck_en/) |
| Sansec eComscan | | N/A |
| Sangfor | | N/A |
| Scumware.org | N/A | [Scumware Removals](https://www.scumware.org/removals.php) |
| SecureAge | N/A | [SecureAge Report FP](https://www.secureaplus.com/features/antivirus/report-false-positive/) |
| Seclookup | | N/A |
| Segasec | | N/A |
| Sentinel One | | N/A |
| SOCRadar | | N/A |
| Sophos | | [Sophos Support](https://support.sophos.com/support/s/article/KB-000033301?language=en_US) |
| Spamhaus | N/A | [Spamhaus DBL Removal](https://check.spamhaus.org/) |
| Sucuri | | N/A |
| Symantec | N/A | [Symantec Submit FP](https://symsubmit.symantec.com/submit/false_positive), [Symantec Content Submission](https://knowledge.broadcom.com/external/article/173729/how-to-submit-false-positives-on-content.html) |
| Tencent | | N/A |
| TheHacker | , | N/A |
| Trapmine | | N/A |
| TrendMicro | , | [TrendMicro Detection Re-evaluation](https://www.trendmicro.com/en_us/about/legal/detection-reevaluation.html) |
| Trustwave | N/A | [Trustwave Detection Review](https://support.trustwave.com/virustotal-detection-review/) |
| Trustlook | | N/A |
| Underworld | | N/A |
| URLQuery | | N/A |
| Varist | , | N/A |
| VBA32 | | N/A |
| Viettel Threat Intelligence | | N/A |
| Vipre | | N/A |
| VirIT | | N/A |
| VirusDie | | N/A |
| Webroot | N/A | [Webroot Vendor Dispute](https://www.webroot.com/us/en/business/support/vendor-dispute-contact-us) |
| WithSecure/F-Secure | , | N/A |
| Xcitium Verdict Cloud (Comodo) | | N/A |
| Yomi | | N/A |
| Yandex | | N/A |
| Yandex Safebrowsing | | N/A |
| Zillya | | N/A |
| ZoneAlarm | | N/A |
| Zoner | | N/A |
---
# Agent Instructions: Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter:
```
GET https://wiki.lucysecurity.com/guides/manage-blacklisted-domains.md?ask=
```
The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.