Why URL reputation services disagree

Guide Updated 25 October 2026

URL reputation services can disagree because they assessed different objects, used different categories or recorded different moments. A domain summary, a page snapshot and a downloaded-file result are not interchangeable. Compare the subject, method, time and collection context before deciding whether two reports actually contradict each other.

A domain, a page and a file are different subjects

Start with three inert examples: the hostname example.test, the URL https://example.test/download and an imaginary file downloaded from that URL. The hostname does not identify one particular response. The URL identifies an address, but its response can change. A file hash identifies particular bytes rather than every object ever distributed from that address.

VirusTotal models these subjects separately. Its domain object describes a domain or fully qualified domain name; its file object is identified by a SHA256 hash¹². The presence of relationships between them is useful context, but a relationship does not merge their meanings. A reported file concern does not become a verdict on every other page sharing the hostname.

For a comparison, write the subject explicitly instead of copying only the service logo and badge. Include the path when the original report includes it. Record the final address separately if a report says navigation redirected. If the report omits a subject detail, label that omission rather than filling it from another service’s display.

The hostname guide explains how to read the address itself. It cannot establish whether the people behind that address are trustworthy. The registrable-domain guide likewise gives a boundary for names, not a certificate of common ownership or identical content across those names.

Different lists ask different questions

The existing service-policy ledger includes scanners, threat-list lookups, community reporting services and configuration checks. That roster is useful for understanding the range of operations. It is not a competition in which all twenty-two entries perform the same test and the highest number of favourable badges wins.

Google’s v4 lookup identifies lists using threat, platform and entry types³. Preserve those selections when explaining a response. “No match in the requested lists” describes evidence more faithfully than “Google approves the site.” A reputation page that does not expose its selected scope leaves a comparison less complete, rather than making its conclusion broader.

HTTP Observatory makes an especially clear comparison case. Its FAQ describes tests of web security measures and explicitly lists important things the tool does not test⁵. A strong configuration grade and an adverse content report can coexist. The first does not refute the second because their questions differ.

Read the report time, not the time you opened it

Two report pages opened together can preserve observations from different days. Put their analysis times side by side before discussing a disagreement. If a service exposes only a record-update time, keep that label. Do not assume it means every contributing engine inspected the destination again at that moment.

urlscan says its scans are point-in-time snapshots and existing scans are not re-crawled⁶. A historical report can show what was encountered earlier while a later observation reflects changed content. The earlier evidence remains relevant to that history. It does not become false merely because the site owner subsequently removed an affected page.

VirusTotal describes a mixture of stored contributor databases and API queries in its website scanning process⁷. That documents more than one way information reaches an aggregated report. It does not establish a measured refresh interval for every visible result, or prove that two services queried at the same time used identical underlying evidence.

Separate three questions: when the underlying content was observed, when a classification was produced and when the display was retrieved. If one time is missing, the honest comparison carries that missing field. The result-state reference covers expired evidence and unfinished work without turning either into a favourable result.

A browser can receive a different page

An address is not always a promise of one fixed response. HTTP content negotiation can choose a representation using request information, including accepted language⁸. Account state and application choices can also affect what a visitor sees. When comparing observations, record the context that the report actually exposes; do not assume it matched your own session.

Cloudflare’s scanner documentation allows a custom user agent and headers, while urlscan’s scan API includes a country option⁹¹⁰. Those are documented collection controls, not measurements of their effect on a particular site. A report that omits them leaves uncertainty about how comparable its observed response is to another capture.

Regional access restrictions can matter too. Criminal IP’s own FAQ describes scan difficulties caused by bot blocking, certain hosting address ranges and collection regions¹¹. An unsuccessful attempt may therefore describe a collection limitation. It does not, by itself, show that the website is unavailable everywhere or lacks harmful content.

Personalised or rotating resources create another distinction. Google’s social-engineering guidance notes that ads can rotate and differ between mobile and desktop presentations¹². That supports checking the collection context in an investigation. It does not justify repeatedly opening a flagged page in an everyday browser to try to reproduce what another service saw.

For a site owner, the useful next evidence comes from the provider’s owner console, relevant server records and file-integrity checks. The deceptive-site guide explains that route. Where a controlled example helps, the redirect observation guide shows why the request context belongs beside each hop.

Compare the same product mode

The policy ledger preserves product boundaries for a reason. VirusTotal’s Private Scanning is a separate offering whose reports omit its partner antivirus and URL-scanning verdicts¹³. A private report and a standard report therefore need not contain the same evidence categories. Fewer displayed results are not, without more information, disagreement between the same tests.

Report visibility is another independent dimension. A service may have public, unlisted or private modes, and the meaning of those labels varies. That difference concerns who can obtain the evidence, not whether the evidence is correct. It should not be used as a shortcut for assigning a provider a higher or lower accuracy rank.

Keep the provider, product and operation together when saving a record. “Looked up an existing report” and “requested new analysis” are different actions even if one interface offers both. The lookup and submission comparison explains why those labels also have privacy and target-contact consequences.

Work through an apparent conflict

Imagine three fictional records for example.test. The first is a hostname classification from Monday. The second is a Tuesday snapshot of https://example.test/offers. The third concerns particular file bytes reportedly downloaded from that page. Suppose their headline labels appear favourable, adverse and unknown, respectively. These are invented teaching records, not real provider responses.

The first comparison question is whether the hostname classification actually covered the offer page. The second is whether Monday’s evidence preceded a content change. The third is what “unknown” means in the file record: no opinion, unsupported analysis and an unfinished request would need different descriptions. None can be settled by counting the three labels.

Now imagine that two completed records really do describe the same URL, category and observation period, but reach opposite conclusions. That is a substantive disagreement worth retaining. Keep the provider’s own explanation and evidence references with each result. Do not declare a false positive merely because one conclusion is inconvenient, or declare certainty merely because a warning is prominent.

Keep disagreement visible in the handoff

A useful handoff states what remains unresolved. For example: “The reports concern the same path, but one lacks an analysis time,” or “The configuration check and phishing report assess different properties.” These sentences identify the missing comparison more clearly than a blended score whose calculation hides unlike inputs.

Agreement is also limited evidence. Several displays may rely on overlapping inputs or methods; their number alone does not establish independent confirmation. This page does not measure those dependencies or provider accuracy. It explains what to preserve so an authorised investigation can examine the actual evidence without bypassing warnings, disclosing sensitive links or treating unknown information as reassurance.

Not covered on this page

• Accuracy rankings, detection-rate measurements or a best-service recommendation.
• A determination that any real warning is correct or mistaken.
• New submissions, live scans or expansion of short links.
• Instructions for bypassing browser protections.