[
  {
    "slug": "0xsi-f33d",
    "name": "0xSI_f33d",
    "aliases": [
      "0xsi_f33d",
      "0xSI_f33d"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://seguranca-informatica.pt/",
    "contacts": [
      {
        "type": "form",
        "url": "https://seguranca-informatica.pt/entre-em-contacto/",
        "label": "Contact the 0xSI_f33d maintainer",
        "scope": "url",
        "source": "https://seguranca-informatica.pt/entre-em-contacto/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://seguranca-informatica.pt/entre-em-contacto/",
        "title": "Official source: seguranca-informatica.pt"
      }
    ],
    "notes": [
      "The maintainer publishes a general contact form with 0xSI_f33d topics. A dedicated false-positive category was not confirmed."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find 0xSI_f33d false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "abuse-ch-sslbl",
    "name": "Abuse.ch SSLBL",
    "aliases": [
      "Abuse.ch Blocklists: C2, JA3, SSL",
      "Abuse.ch"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://sslbl.abuse.ch/",
    "contacts": [
      {
        "type": "form",
        "url": "https://contact.abuse.ch/",
        "label": "abuse.ch false-positive contact form",
        "scope": "rules",
        "source": "https://contact.abuse.ch/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://sslbl.abuse.ch/about/",
        "title": "SSLBL About"
      },
      {
        "url": "https://contact.abuse.ch/",
        "title": "abuse.ch Contact Us"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "abuse.ch provides a contact form with a false-positive reporting category for its threat-data projects.",
    "cautions": [],
    "guides": [
      {
        "scope": "rules",
        "steps": [
          "Open the abuse.ch contact form and choose Report a false positive.",
          "Identify SSLBL and include the exact listed certificate fingerprint, JA3 fingerprint or IP address, the rule ID if applicable, and the VirusTotal report link.",
          "Explain the legitimate use and why the match is incorrect, enter your contact details, and complete the CAPTCHA."
        ],
        "cautions": [
          "Identify the affected abuse.ch project so the report can be routed correctly."
        ],
        "description": "abuse.ch provides a contact form with a false-positive reporting category for its threat-data projects."
      }
    ],
    "indexable": true
  },
  {
    "slug": "abusix",
    "name": "Abusix",
    "aliases": [
      "Abusix",
      "abusix"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://abusix.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://lookup.abusix.com/",
        "label": "Lookup and delist",
        "scope": "url",
        "source": "https://abusix.com/blog/blocklist-lookup-delist-service/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:support@abusix.com",
        "label": "Ask Abusix support",
        "scope": "url",
        "source": "https://abusix.com/blog/blocklist-lookup-delist-service/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://abusix.com/blog/blocklist-lookup-delist-service/",
        "title": "Abusix Lookup & Delist: check and remove a blocklisting"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Abusix provides a lookup and delisting portal for listed domains and IP addresses.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Look up the affected domain or IP and read which Abusix list applies.",
          "Confirm that you manage the affected system and fix the cause of the listing.",
          "Sign in or create a free account, verify your email, and choose Remove from list."
        ],
        "cautions": [
          "If the listed system belongs to a hosting or email provider, ask its administrator to resolve the cause.",
          "Abusix support can help explain the evidence behind a listing."
        ],
        "description": "Abusix provides a lookup and delisting portal for listed domains and IP addresses."
      }
    ],
    "indexable": true
  },
  {
    "slug": "acronis",
    "name": "Acronis",
    "aliases": [
      "Acronis (Static ML)",
      "acronis",
      "Acronis"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "https://www.acronis.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal-falsepositive@acronis.com",
        "label": "virustotal-falsepositive@acronis.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "email",
        "url": "mailto:virustotal-falsepositive@acronis.com",
        "label": "Acronis contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Acronis false-positive review channels for files and websites / URLs. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email virustotal-falsepositive@acronis.com with the VirusTotal report URL, exact Acronis detection label and SHA-256 of the affected file.",
          "Explain what the file does and why the detection appears incorrect; identify the software publisher and official download location if applicable.",
          "Ask for a false-positive review and follow any instructions returned by the vendor."
        ],
        "cautions": [
          "This contact is listed by VirusTotal. Its current delivery and response behavior have not been independently tested."
        ],
        "description": "VirusTotal lists this address for false positives from the Acronis file-scanning engine."
      },
      {
        "scope": "url",
        "steps": [
          "Record the exact affected URL or domain and detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "adminuslabs",
    "name": "ADMINUSLabs",
    "aliases": [
      "ADMINUSLABS",
      "ADMINUSLabs",
      "adminuslabs"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.adminuslabs.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:samples@adminus.net",
        "label": "samples@adminus.net",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find ADMINUSLabs false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "aegislab",
    "name": "AegisLab",
    "aliases": [
      "aegislab",
      "AegisLab"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@aegislab.com",
        "label": "support@aegislab.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find AegisLab false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "ahnlab",
    "name": "AhnLab",
    "aliases": [
      "AhnLab-V3",
      "ahnlab",
      "ahnlab_v3",
      "Ahnlab",
      "AhnLab"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://global.ahnlab.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:v3sos@ahnlab.com",
        "label": "v3sos@ahnlab.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find AhnLab false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "alibaba",
    "name": "Alibaba",
    "aliases": [
      "Alibaba Group",
      "alibaba",
      "Alibaba"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.alibabagroup.com/en/global/home",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@list.alibaba-inc.com",
        "label": "virustotal@list.alibaba-inc.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Alibaba false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "alicloud",
    "name": "AliCloud",
    "aliases": [
      "Alibaba Cloud",
      "alibabacloud",
      "AliCloud"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.alibabacloud.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:antivirus@alibabacloud.com",
        "label": "antivirus@alibabacloud.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find AliCloud false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "alienvault",
    "name": "AlienVault",
    "aliases": [
      "AlienVault",
      "alienvault"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.alienvault.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:otx-support@alienvault.com",
        "label": "otx-support@alienvault.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find AlienVault false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "alienvault-labs",
    "name": "Alienvault-Labs",
    "aliases": [
      "Alienvault-Labs"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/AlienVault-Labs/AlienVaultLabs",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/AlienVault-Labs/AlienVaultLabs",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Alienvault-Labs false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "alphamountain-ai",
    "name": "alphaMountain.ai",
    "aliases": [
      "AlphaMountain",
      "alphamountain_ai",
      "alphaMountain.ai"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://alphamountain.ai/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.alphamountain.ai/false-positive/",
        "label": "Report a false positive",
        "scope": "url",
        "source": "https://www.alphamountain.ai/false-positive/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://alphamountain.freshdesk.com/support/tickets/new",
        "label": "Support request form",
        "scope": "url",
        "source": "https://www.alphamountain.ai/false-positive/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.alphamountain.ai/false-positive/",
        "title": "Report a false positive"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "alphaMountain accepts false-positive reports and disputes of website classification through its support form.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open the official false-positive page and follow its link to the support form.",
          "Describe the website classification you dispute and provide the affected domain or URL.",
          "Complete the form's requested contact and case details, then retain the support reference."
        ],
        "cautions": [
          "The linked Freshdesk form may require sign-in."
        ],
        "description": "alphaMountain accepts false-positive reports and disputes of website classification through its support form."
      }
    ],
    "indexable": true
  },
  {
    "slug": "alphasoc",
    "name": "AlphaSOC",
    "aliases": [
      "AlphaSOC",
      "alphasoc"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://alphasoc.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@alphasoc.com",
        "label": "virustotal@alphasoc.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find AlphaSOC false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "antiy",
    "name": "Antiy",
    "aliases": [
      "Antiy Labs",
      "Antiy-AVL",
      "antiy_avl",
      "Antiy"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.antiy.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:avlsdk_support@antiy.cn",
        "label": "avlsdk_support@antiy.cn",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Antiy false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "apex",
    "name": "APEX",
    "aliases": [
      "apex"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "form",
        "url": "https://uav.secureage.com/falsepositive/index.php",
        "label": "SecureAge file false-positive form",
        "source": "https://www.secureage.com/contact-us",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://blog.virustotal.com/2019/05/virustotal-secureage.html",
        "title": "VirusTotal welcomes SecureAge APEX"
      },
      {
        "url": "https://www.secureage.com/contact-us",
        "title": "SecureAge Contact Us"
      },
      {
        "url": "https://uav.secureage.com/falsepositive/index.php",
        "title": "SecureAge false-positive file upload"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "VirusTotal introduced APEX as SecureAge's scanner. The current SecureAge file form is a route for asking about a legacy APEX result.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "State that the disputed VirusTotal result uses the historical APEX name.",
          "Open the SecureAge false-positive form.",
          "Enter your email and a description including the detection details and the file's legitimate purpose.",
          "Select or drag the affected file into the form, and choose whether to receive verification by email.",
          "Complete the upload and retain any confirmation."
        ],
        "cautions": [
          "This is a legacy engine name. Availability of a historical verdict review must be confirmed with the current vendor.",
          "The linked form accepts files up to 30 MB.",
          "SecureAge's contact page describes this workflow as supporting CatchPulse and its detecting engines."
        ],
        "description": "VirusTotal introduced APEX as SecureAge's scanner. The current SecureAge file form is a route for asking about a legacy APEX result."
      }
    ],
    "indexable": false
  },
  {
    "slug": "arcabit",
    "name": "Arcabit",
    "aliases": [
      "Arcabit",
      "arcabit"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.arcabit.pl/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vt.fp@arcabit.pl",
        "label": "vt.fp@arcabit.pl",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Arcabit false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "arcsight-threat-intelligence",
    "name": "ArcSight Threat Intelligence",
    "aliases": [
      "OpenText",
      "arcsight_threat_intelligence",
      "ArcSight Threat Intelligence"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.microfocus.com/en-us/cyberres/secops/arcsight-esm",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotalsupport@opentext.com",
        "label": "virustotalsupport@opentext.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find ArcSight Threat Intelligence false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "arctic-wolf",
    "name": "Arctic Wolf",
    "aliases": [
      "Aurora® Endpoint Security",
      "Arctic Wolf (Aurora)",
      "Arctic Wolf"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://arcticwolf.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@arcticwolf.com",
        "label": "virustotal@arcticwolf.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Arctic Wolf false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "armis",
    "name": "Armis",
    "aliases": [
      "Armis"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.armis.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.armis.com/about/contact-us/",
        "label": "Armis general contact",
        "scope": "url",
        "source": "https://www.armis.com/about/contact-us/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://support.armis.com/",
        "label": "Armis support portal (login may be required)",
        "scope": "url",
        "source": "https://www.armis.com/about/contact-us/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.armis.com/about/contact-us/",
        "title": "Official source: www.armis.com"
      }
    ],
    "notes": [
      "Armis directs technical support requests to its support portal. A public VirusTotal-specific false-positive form was not found."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find Armis false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "autoshun",
    "name": "AutoShun",
    "aliases": [
      "RiskAnalytics",
      "autoshun",
      "AutoShun"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://riskanalytics.com/autoshun/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@riskanalytics.com",
        "label": "RiskAnalytics support for legacy feed questions",
        "scope": "url",
        "source": "https://riskanalytics.com/community/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://riskanalytics.com/community/",
        "label": "Read the feed retirement notice",
        "scope": "url",
        "source": "https://riskanalytics.com/community/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://riskanalytics.com/community/",
        "title": "Official source: riskanalytics.com"
      }
    ],
    "notes": [
      "RiskAnalytics states that AutoShun and Malware Domains have been shut off and incorporated into ShadowNet. The legacy name can still appear in VirusTotal documentation.",
      "The published support mailbox is a fallback for questions about a legacy verdict, not a confirmed active delisting form."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "retired",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find AutoShun false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "activity": "retired-source",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "avast",
    "name": "Avast",
    "aliases": [
      "Avast Software",
      "Avast-Mobile",
      "avast",
      "avast_mobile",
      "Avast"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.avast.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.avast.com/report-false-positive",
        "label": "Report a false positive",
        "source": "https://support.avast.com/avast/en/ww/home/current/solutions/submit-file-url",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://support.avast.com/avast/en/ww/home/current/solutions/submit-file-url",
        "title": "Submitting a file or URL to Avast for review"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Use Avast's dedicated false-positive form to request a review of a detected file.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open the false-positive form and select File.",
          "Enter your email, detection name and Alert ID if available; attach the detected sample and explain why it should be considered clean.",
          "Complete the verification and submit the report."
        ],
        "cautions": [
          "Avast specifies one sample, up to 500 MB, in a ZIP or RAR archive without password protection.",
          "The file-review process is for detected files; undetected files are not processed."
        ],
        "description": "Use Avast's dedicated false-positive form to request a review of a detected file."
      }
    ],
    "indexable": true
  },
  {
    "slug": "avg",
    "name": "AVG",
    "aliases": [
      "AVG Technologies",
      "avg",
      "AVG"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.avg.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.avg.com/en-us/report-false-positive",
        "label": "AVG false-positive form",
        "source": "https://www.avg.com/en-us/report-false-positive",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.avg.com/en-us/report-false-positive",
        "title": "AVG Report False Positive"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "AVG provides a false-positive form with separate file and URL options.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open the form and select File.",
          "Supply your email and attach the file. Add the AVG detection name, Alert ID and a description of the suspected mistake.",
          "Complete the verification question and submit."
        ],
        "cautions": [
          "Choose the File option for a file detection; a website URL is a separate submission type."
        ],
        "description": "AVG provides a false-positive form with separate file and URL options."
      }
    ],
    "indexable": true
  },
  {
    "slug": "avira",
    "name": "Avira",
    "aliases": [
      "Avira (no cloud)",
      "avira",
      "antivir",
      "antivir7",
      "Antivir (Avira)",
      "Avira"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.avira.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.avira.com/en/analysis/submit",
        "label": "Submit a file to Avira",
        "source": "https://support.avira.com/hc/en-us/articles/360002183358-What-is-a-false-positive-Avira-Antivirus-detection",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "form",
        "url": "https://www.avira.com/en/analysis/submit-url",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://support.avira.com/hc/en-us/articles/360002183358-What-is-a-false-positive-Avira-Antivirus-detection",
        "title": "What is a false positive Avira Antivirus detection?"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Avira false-positive review channels for files and websites / URLs. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Update Avira's virus definitions and scan the file again.",
          "If the detection persists, open Avira's file submission portal.",
          "Submit the affected sample with the detection details and an explanation of its legitimate purpose."
        ],
        "cautions": [
          "The vendor support page confirms the file submission route; the upload form itself returned an access restriction during this check."
        ],
        "description": "Avira's support guidance directs persistent false file detections to its file submission portal."
      },
      {
        "scope": "url",
        "steps": [
          "Record the exact affected URL or domain and detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "avware",
    "name": "AVware",
    "aliases": [
      "avware"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:falecom@bluepex.com",
        "label": "BluePex general contact",
        "scope": "file",
        "source": "https://marketing.bluepex.com/downloads/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://marketing.bluepex.com/downloads/",
        "title": "BluePex general contact"
      },
      {
        "url": "https://blog.virustotal.com/2014/07/",
        "title": "VirusTotal July 2014: BluePex AVware"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "VirusTotal introduced AVware as a BluePex antivirus. BluePex publishes a general business contact that can be asked to route a historical AVware review.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Use the official general contact below and ask for the team responsible for AVware's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, exact detection label and software publisher. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "This is a historical engine name; the current contact is a general business inquiry address, not a confirmed AVware appeal desk.",
          "The official contact information is in Portuguese."
        ],
        "description": "VirusTotal introduced AVware as a BluePex antivirus. BluePex publishes a general business contact that can be asked to route a historical AVware review."
      }
    ],
    "indexable": false
  },
  {
    "slug": "babable",
    "name": "Babable",
    "aliases": [
      "babable",
      "WhiteArmor"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file-engine search prefixes"
      },
      {
        "url": "https://web.archive.org/web/20180628021807/http://babable.com/",
        "title": "Babable official homepage captured June 28, 2018"
      },
      {
        "url": "https://web.archive.org/web/20190414163815/http://www.babable.com:80/",
        "title": "Babable official homepage captured April 14, 2019"
      },
      {
        "url": "https://dns.google/resolve?name=babable.com&type=MX",
        "title": "Google Public DNS lookup for Babable MX"
      },
      {
        "url": "https://cloudflare-dns.com/dns-query?name=babable.com&type=MX",
        "title": "Cloudflare DNS lookup for Babable MX"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "The VirusTotal file-prefix list includes this historical name, but no current official contact was verified. Third-party directories alone were not accepted as contact evidence.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed.",
      "The archived official Babable homepage confirms that WhiteArmor rebranded to Babable. Both VirusTotal engine-prefix records are preserved because the brand relationship does not establish current engine activity or support.",
      "Recovered historical email addresses are evidence of earlier company contact details; none is verified as a current appeal channel."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "unresolved",
    "contactStatus": "historical-only",
    "steps": [
      "Re-analyse the existing VirusTotal item and record whether Babable still appears, along with the result date, SHA-256 and exact detection.",
      "Check both Babable and its former WhiteArmor name when tracing the engine owner. The archived company page explicitly confirms this rebrand.",
      "Do not rely on the old obu@babable.com address as a current route: both DNS resolvers queried returned NXDOMAIN for the domain during this audit."
    ],
    "description": "Babable was the new name of WhiteArmor, according to its archived official homepage. A historical engine-cooperation email is confirmed, but no current vendor appeal channel was verified.",
    "cautions": [
      "The historical email was published for AI antivirus-engine cooperation, not explicitly for false-positive appeals.",
      "babable.com and whitearmor.ai returned NXDOMAIN in Google Public DNS and Cloudflare DNS checks on October 14, 2026. These old domain-based mail addresses are not currently usable as normal Internet mail destinations.",
      "The engine remains in VirusTotal's allowed file-search prefixes. A search-prefix listing does not establish that the vendor is currently operating.",
      "No message or SMTP delivery test was sent."
    ],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Re-analyse the existing VirusTotal item and record whether Babable still appears, along with the result date, SHA-256 and exact detection.",
          "Check both Babable and its former WhiteArmor name when tracing the engine owner. The archived company page explicitly confirms this rebrand.",
          "Do not rely on the old obu@babable.com address as a current route: both DNS resolvers queried returned NXDOMAIN for the domain during this audit."
        ],
        "cautions": [
          "The historical email was published for AI antivirus-engine cooperation, not explicitly for false-positive appeals.",
          "babable.com and whitearmor.ai returned NXDOMAIN in Google Public DNS and Cloudflare DNS checks on October 14, 2026. These old domain-based mail addresses are not currently usable as normal Internet mail destinations.",
          "The engine remains in VirusTotal's allowed file-search prefixes. A search-prefix listing does not establish that the vendor is currently operating.",
          "No message or SMTP delivery test was sent."
        ],
        "description": "Babable was the new name of WhiteArmor, according to its archived official homepage. A historical engine-cooperation email is confirmed, but no current vendor appeal channel was verified."
      }
    ],
    "indexable": false,
    "historicalContacts": [
      {
        "type": "email",
        "url": "mailto:obu@babable.com",
        "label": "Historical vendor-published contact — obu@babable.com",
        "scope": "file",
        "source": "https://web.archive.org/web/20180628021807/http://babable.com/",
        "sourceCapturedAt": "2018-06-28",
        "currentStatus": "domain-nxdomain",
        "useAsActiveContact": false,
        "note": "Reconfirmed in the April 14, 2019 homepage capture. The official page identifies this as an antivirus-engine cooperation contact; current domain DNS is NXDOMAIN."
      }
    ],
    "evidenceNotes": [
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20180628021807/http://babable.com/",
        "observation": "The vendor page states: \"We were called whitearmor, and we have just rebranded to Babable.\" It then publishes obu@babable.com for AI antivirus-engine cooperation."
      },
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20190414163815/http://www.babable.com:80/",
        "observation": "The later capture contains the same brand-transition statement and same email."
      },
      {
        "level": "current-dns-observation",
        "source": "https://dns.google/resolve?name=babable.com&type=MX",
        "observation": "MX, A and NS lookups all returned DNS Status 3 (NXDOMAIN). An independent Cloudflare MX query also returned Status 3."
      },
      {
        "level": "relationship-confirmed",
        "source": "https://web.archive.org/web/20180628021807/http://babable.com/",
        "observation": "A WhiteArmor → Babable historical brand relationship is supported. No successor after Babable was verified."
      }
    ],
    "relatedVendors": [
      {
        "slug": "whitearmor",
        "name": "WhiteArmor",
        "relationship": "former-name",
        "source": "https://web.archive.org/web/20180628021807/http://babable.com/"
      }
    ]
  },
  {
    "slug": "baidu",
    "name": "Baidu",
    "aliases": [
      "Baidu-International",
      "baidu",
      "Baidu"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://antivirus.baidu.com/en/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:bav@baidu.com",
        "label": "bav@baidu.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "email",
        "url": "mailto:gaoyingchun@baidu.com",
        "label": "gaoyingchun@baidu.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Baidu false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "benkowcc",
    "name": "BenkowCC",
    "aliases": [
      "Benkow",
      "benkow_cc",
      "BenkowCC"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://benkow.cc/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:mail@benkow.cc",
        "label": "Public maintainer email",
        "scope": "url",
        "source": "https://benkow.cc/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://benkow.cc/",
        "title": "Official source: benkow.cc"
      }
    ],
    "notes": [
      "The contributor homepage publishes this mailbox without a dedicated appeal procedure."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find BenkowCC false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "bforeai",
    "name": "BforeAI",
    "aliases": [
      "BforeAi",
      "BeforeAi",
      "bfore_ai_precrime"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://bfore.ai/",
    "contacts": [
      {
        "type": "form",
        "url": "https://bfore.ai/support/",
        "label": "VirusTotal and Quad9 false-flag support",
        "scope": "url",
        "source": "https://bfore.ai/contact/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://bfore.ai/contact/",
        "title": "BforeAI contact: VirusTotal or Quad9 false flags"
      },
      {
        "url": "https://portal.bfore.ai/knowledge-base/how-do-i-report-a-false-positive-1",
        "title": "BforeAI platform false-positive instructions"
      },
      {
        "url": "https://virustotal.readme.io/docs/false-positive-contacts",
        "title": "VirusTotal false-positive reporting guidance"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "BforeAI explicitly directs VirusTotal and Quad9 false-flag reports to its support form.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open BforeAI's support page using the false-flag link on its contact page.",
          "Complete the support form with the affected domain and the classification you dispute.",
          "For a VirusTotal report, include the report link and a concise explanation of the suspected error."
        ],
        "cautions": [
          "Customers with platform access can also report a false positive from the attack-detail page's three-dot menu."
        ],
        "description": "BforeAI explicitly directs VirusTotal and Quad9 false-flag reports to its support form."
      }
    ],
    "indexable": true
  },
  {
    "slug": "bitdam",
    "name": "Bitdam",
    "aliases": [
      "Bitdam ATP"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://bitdam.com/",
    "contacts": [
      {
        "type": "support",
        "url": "https://www.datto.com/support/",
        "label": "Datto partner support",
        "scope": "sandbox",
        "source": "https://www.datto.com/support/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.datto.com/support/",
        "title": "Datto partner support"
      },
      {
        "url": "https://www.datto.com/fr/news/press-releases/datto-acquires-cyber-threat-detection-company-bitdam/",
        "title": "Datto acquires BitDam"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Datto acquired BitDam and incorporated its technology into SaaS Defense. Its partner support hub is the current organizational route for asking about a BitDam analysis.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for Bitdam's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "Datto requires a partner login for tickets. Clients of partners are directed to their managed service provider.",
          "This route does not establish that Datto can revise every historical BitDam VirusTotal report."
        ],
        "description": "Datto acquired BitDam and incorporated its technology into SaaS Defense. Its partner support hub is the current organizational route for asking about a BitDam analysis."
      }
    ],
    "indexable": true
  },
  {
    "slug": "bitdefender",
    "name": "Bitdefender",
    "aliases": [
      "BitDefender GmbH",
      "BitDefender",
      "BitDefenderFalx",
      "BitDefenderTheta",
      "bitdefender",
      "bitdefenderfalx",
      "bitdefendertheta"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.bitdefender.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.bitdefender.com/consumer/support/answer/29358/",
        "label": "Submit a website or URL",
        "scope": "url",
        "source": "https://community.bitdefender.com/en/discussion/106310/process-to-remove-website-from-bitdefender-trafficlight",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:virus_submission@bitdefender.com",
        "label": "virus_submission@bitdefender.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.bitdefender.com/business/support/en/77211-343057-submitting-sample-files-and-websites-for-analysis.html",
        "title": "Submitting sample files and websites for analysis"
      },
      {
        "url": "https://community.bitdefender.com/en/discussion/106310/process-to-remove-website-from-bitdefender-trafficlight",
        "title": "Bitdefender support: submitting a TrafficLight URL for review"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Bitdefender false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open the submission form and select False Positive as the category and URL as the sample type.",
          "Provide your product and contact details, the affected URL, and the detection name.",
          "Attach a screenshot of the website detection and submit the completed request."
        ],
        "cautions": [
          "Choose URL for a blocked website; a file upload addresses a different detection type."
        ],
        "description": "Bitdefender's sample-submission workflow accepts website and URL false positives for review by Bitdefender Labs."
      },
      {
        "scope": "file",
        "steps": [
          "Record the file SHA-256, filename and exact detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "bkav",
    "name": "Bkav",
    "aliases": [
      "Bkav Corporation",
      "Bkav Pro",
      "bkav",
      "bkav_pro",
      "Bkav"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.bkav.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:fpreport@bkav.com",
        "label": "fpreport@bkav.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "email",
        "url": "mailto:bkav@bkav.com",
        "label": "bkav@bkav.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Bkav false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "blaze-s-security",
    "name": "Blaze's Security",
    "aliases": [
      "bartblaze",
      "Blaze's Security"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/bartblaze/Yara-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/bartblaze/Yara-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Blaze's Security false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "blueliv",
    "name": "Blueliv",
    "aliases": [
      "Blueliv",
      "blueliv"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.blueliv.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:klabs_services@outpost24.com",
        "label": "klabs_services@outpost24.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Blueliv false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cape",
    "name": "CAPE",
    "aliases": [
      "CAPEv2",
      "Malware Configuration and Payload Extraction"
    ],
    "scopes": [
      "rules",
      "sandbox"
    ],
    "website": "https://capesandbox.com/",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/kevoreilly/CAPEv2",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products",
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find CAPE false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "certego",
    "name": "Certego",
    "aliases": [
      "Certego",
      "certego"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.certego.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:fp@certego.net",
        "label": "fp@certego.net",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Certego false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "chainpatrol",
    "name": "ChainPatrol",
    "aliases": [
      "ChainPatrol"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://chainpatrol.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://app.chainpatrol.io/dispute",
        "label": "Dispute asset status",
        "scope": "url",
        "source": "https://chainpatrol.io/docs/general/false-positives",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://chainpatrol.io/docs/general/false-positives",
        "title": "ChainPatrol false-positive documentation"
      },
      {
        "url": "https://app.chainpatrol.io/dispute",
        "title": "Dispute asset status form"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "ChainPatrol provides a public dispute form for assets incorrectly marked allowed or blocked.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open the Dispute asset status form.",
          "Provide the affected domain or URL, your email address, and any relevant explanation.",
          "Submit the dispute and respond if ChainPatrol requests clarification."
        ],
        "cautions": [
          "The current form says disputes are considered only from the domain owner or an authorized representative."
        ],
        "description": "ChainPatrol provides a public dispute form for assets incorrectly marked allowed or blocked."
      }
    ],
    "indexable": true
  },
  {
    "slug": "chong-lua-dao",
    "name": "Chong Lua Dao",
    "aliases": [
      "Chong Lua Dao",
      "chong_lua_dao"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://chongluadao.vn/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:info@chongluadao.vn",
        "label": "info@chongluadao.vn",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Chong Lua Dao false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cins-army",
    "name": "CINS Army",
    "aliases": [
      "Sentinel IPS",
      "cins_army",
      "CINS Army (Sentinel IPS)",
      "CINS Army"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://cinsscore.com/",
    "contacts": [
      {
        "type": "support",
        "url": "http://cinsscore.com/#contact",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find CINS Army false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "clamav",
    "name": "ClamAV",
    "aliases": [
      "ClamAV",
      "clamav"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.clamav.net/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.clamav.net/reports/fp",
        "label": "ClamAV false-positive report",
        "source": "https://docs.clamav.net/",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://docs.clamav.net/",
        "title": "ClamAV documentation: submitting malware and false positives"
      },
      {
        "url": "https://docs.clamav.net/faq/faq-malware-fp-reports.html",
        "title": "Malware and False Positive Report FAQ"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "ClamAV directs benign files incorrectly detected by its scanner to the official false-positive report form.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Confirm that ClamAV and its signature databases are current.",
          "Open the false-positive report form and provide the detected sample.",
          "Include the signature or detection name and enough context for the analysts to reproduce the detection."
        ],
        "cautions": [
          "ClamAV says uploaded samples are retained indefinitely within Cisco Talos.",
          "The official documentation confirms the form URL; automated access to the form returned HTTP 403 during this check."
        ],
        "description": "ClamAV directs benign files incorrectly detected by its scanner to the official false-positive report form."
      }
    ],
    "indexable": true
  },
  {
    "slug": "clean-mx",
    "name": "Clean-MX",
    "aliases": [
      "CLEAN MX",
      "Clean-MX"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.clean-mx.de/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:abuse@clean-mx.de",
        "label": "abuse@clean-mx.de",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Clean-MX false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cluster25",
    "name": "Cluster25",
    "aliases": [
      "DuskRise",
      "cluster25",
      "Cluster25"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.duskrise.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:threatintel@cluster25.io",
        "label": "threatintel@cluster25.io",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Cluster25 false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cmc",
    "name": "CMC",
    "aliases": [
      "CMC InfoSec",
      "CMC Cyber Security",
      "CMC Threat Intelligence",
      "cmc_threat_intelligence",
      "cmc",
      "CMC"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www3.cmcinfosec.com/san-pham/cmc-antivirus/14.epi",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:PSIRT@cmccybersecurity.com",
        "label": "PSIRT@cmccybersecurity.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find CMC false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "commtouch",
    "name": "Commtouch",
    "aliases": [
      "commtouch"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@varist.com",
        "label": "Varist file-engine support listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://www.prnewswire.com/news-releases/commtouch-is-now-cyren-239025151.html",
        "title": "Commtouch announcement: Commtouch is now CYREN"
      },
      {
        "url": "https://data443.com/faq-data443-acquire-cyren/",
        "title": "Data443 FAQ: Cyren assets and Varist anti-malware services"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Commtouch became Cyren. Varist acquired Cyren's anti-malware products; the file-engine review route is distinct from Cyren's former URL and email services.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email Varist support and identify the historical Commtouch engine name shown by VirusTotal.",
          "Include the file SHA-256, VirusTotal report URL, detection label and evidence of legitimate use.",
          "Ask whether the team can review the legacy engine result; follow its current sample-submission instructions."
        ],
        "cautions": [
          "This is a legacy name. The successor relationship does not guarantee that a historical VirusTotal verdict can still be changed.",
          "The support address is listed in VirusTotal's current contact directory; email delivery has not been tested."
        ],
        "description": "Commtouch became Cyren. Varist acquired Cyren's anti-malware products; the file-engine review route is distinct from Cyren's former URL and email services."
      }
    ],
    "indexable": false
  },
  {
    "slug": "crdf",
    "name": "CRDF",
    "aliases": [
      "CRDF FRANCE",
      "crdf",
      "CRDF"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.crdf.fr/",
    "contacts": [
      {
        "type": "form",
        "url": "https://threatcenter.crdf.fr/false_positive.html",
        "label": "Request a false-positive review",
        "scope": "url",
        "source": "https://threatcenter.crdf.fr/false_positive.html",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://threatcenter.crdf.fr/false_positive.html",
        "title": "CRDF false-positive review procedure"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "CRDF has a dedicated review form for clean URLs or domains that appear incorrectly classified.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Check the exact indicator in CRDF Threat Center before requesting a review.",
          "Provide an HTTP or HTTPS URL, a reachable email address, and a reason describing the incorrect classification or what changed.",
          "Include affected URLs, cleanup dates, and supporting evidence. Keep the tracking link and add follow-up information to the existing case."
        ],
        "cautions": [
          "Duplicate active requests are not created. The form currently supports up to five URLs per submission."
        ],
        "description": "CRDF has a dedicated review form for clean URLs or domains that appear incorrectly classified."
      }
    ],
    "indexable": true
  },
  {
    "slug": "criminal-ip",
    "name": "Criminal IP",
    "aliases": [
      "AI Spera",
      "criminal_ip",
      "Criminal IP (AI Spera)",
      "Criminal IP"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.criminalip.io/en",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@aispera.com",
        "label": "AI Spera support",
        "scope": "url",
        "source": "https://virustotal.readme.io/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://virustotal.readme.io/docs/false-positive-contacts",
        "title": "VirusTotal false-positive contacts"
      },
      {
        "url": "https://www.criminalip.io/",
        "title": "Criminal IP technical-support contact"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "VirusTotal lists AI Spera's support email for Criminal IP false positives; the vendor also publishes it as its technical-support contact.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Email support@aispera.com identifying Criminal IP as the engine with the disputed verdict.",
          "Include the exact domain or URL and a link to the VirusTotal report.",
          "Explain why you believe the verdict is incorrect and request a review."
        ],
        "cautions": [
          "No separate public URL-specific appeal procedure was verified. These steps use VirusTotal's general false-positive reporting guidance."
        ],
        "description": "VirusTotal lists AI Spera's support email for Criminal IP false positives; the vendor also publishes it as its technical-support contact."
      }
    ],
    "indexable": true
  },
  {
    "slug": "crowdsec",
    "name": "CrowdSec",
    "aliases": [
      "crowdsec"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.crowdsec.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@crowdsec.net",
        "label": "CrowdSec CTI false-positive review",
        "scope": "url",
        "source": "https://docs.crowdsec.net/u/troubleshooting/cti/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://docs.crowdsec.net/u/troubleshooting/cti/",
        "label": "Read the IP false-positive requirements",
        "scope": "url",
        "source": "https://docs.crowdsec.net/u/troubleshooting/cti/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.crowdsec.net/u/troubleshooting/cti/",
        "title": "Official source: docs.crowdsec.net"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This process concerns IP threat-intelligence classification; it is not a general domain allowlisting form.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Prepare a technical explanation for why the IP or range is misclassified.",
      "Publish the relevant IP addresses, ranges or reverse DNS as a machine-readable list available over HTTPS.",
      "Email support@crowdsec.net with that list URL, your justification and the VirusTotal report link."
    ],
    "description": "Find CrowdSec false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "crowdstrike",
    "name": "CrowdStrike",
    "aliases": [
      "CrowdStrike Falcon",
      "crowdstrike",
      "CrowdStrike"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.crowdstrike.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:VTscanner@crowdstrike.com",
        "label": "CrowdStrike contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "VirusTotal lists a scanner-specific contact for CrowdStrike file verdicts.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email VTscanner@crowdstrike.com with the VirusTotal report URL, exact CrowdStrike detection label and SHA-256 of the affected file.",
          "Explain what the file does and why the detection appears incorrect; identify the software publisher and official download location if applicable.",
          "Ask for a false-positive review and follow any instructions returned by the vendor."
        ],
        "cautions": [
          "This contact is listed by VirusTotal. Its current delivery and response behavior have not been independently tested."
        ],
        "description": "VirusTotal lists a scanner-specific contact for CrowdStrike file verdicts."
      }
    ],
    "indexable": true
  },
  {
    "slug": "csis-security-group",
    "name": "CSIS Security Group",
    "aliases": [
      "CSIS Security Group"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.csis.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:abuse-reporting@csis.com",
        "label": "abuse-reporting@csis.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find CSIS Security Group false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cyan",
    "name": "Cyan",
    "aliases": [
      "Cyan Digital Security",
      "CyanSecurity",
      "cyan"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.cyansecurity.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@cyansecurity.com",
        "label": "virustotal@cyansecurity.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Cyan false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cyber-adapt",
    "name": "cyber adAPT",
    "aliases": [
      "cyberadapt",
      "cyber adAPT"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "",
    "contacts": [],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://web.archive.org/web/20250328125817/https://www.cyberadapt.com/contact",
        "title": "cyber adAPT official contact page captured March 28, 2025"
      },
      {
        "url": "https://web.archive.org/web/20190328160705/https://www.cyberadapt.com/cyber-adapt-contact-us.html",
        "title": "cyber adAPT official contact page captured March 28, 2019"
      },
      {
        "url": "https://www.niagaranetworks.com/hubfs/Niagara%20-%20Cyber%20adAPT%20Solution%20Brief.pdf",
        "title": "Official Niagara Networks and Cyber adAPT joint solution brief, July 2023"
      },
      {
        "url": "https://www.niagaranetworks.com/resources",
        "title": "Current Niagara Networks resources page lists the Cyber adAPT joint solution"
      },
      {
        "url": "https://www.niagaranetworks.com/support",
        "title": "Niagara Networks official support"
      },
      {
        "url": "https://dns.google/resolve?name=cyberadapt.com&type=MX",
        "title": "Google Public DNS lookup for cyber adAPT MX"
      }
    ],
    "notes": [
      "The website named in the VirusTotal contributor roster redirected to unrelated gambling content during the 2026-10-14 review. That link is intentionally omitted. A current official contact for this legacy sandbox entry has not been established.",
      "The contributor website now redirects to an unrelated gambling domain. Do not link it or send samples there. No current official alternative was verified.",
      "Official contact-page archives recover historical company emails and a phone number. Current control and availability are unconfirmed; they are excluded from current contact totals.",
      "Niagara Networks is a documented technology partner. Its support link is retained separately for existing joint-product customers seeking routing, with no claim that it owns cyber adAPT or can change its VirusTotal verdicts."
    ],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "unresolved",
    "contactStatus": "historical-only",
    "steps": [
      "Record the VirusTotal behavior-report URL, analysis ID, file hash and the exact cyber adAPT finding being disputed.",
      "Customers of the documented Niagara Networks–Cyber adAPT joint solution can ask Niagara Networks support to identify the current product-support contact.",
      "Provide the report reference and ask for routing first. Niagara Networks is a technology partner; no evidence establishes that it controls cyber adAPT's VirusTotal verdicts."
    ],
    "description": "A March 2025 archive of cyber adAPT's official contact page confirms historical company emails and a phone number. The present domain is unrelated to the vendor, so those details cannot be treated as a verified current appeal channel.",
    "historicalWebsite": "https://www.cyberadapt.com/",
    "activity": "website-no-longer-matches",
    "cautions": [
      "The old cyberadapt.com website redirects to an unrelated gambling site; it is excluded from active vendor links.",
      "The archived info@cyberadapt.com and sales@cyberadapt.com addresses belong to that repurposed domain and must not be offered as verified current mailboxes.",
      "Current DNS returns no MX answer for cyberadapt.com. This observation alone does not prove that every mail-delivery mechanism is impossible; the decisive concern is the lack of current vendor ownership evidence.",
      "Niagara Networks is a documented partner, not a confirmed acquirer or replacement owner. Its support route is suitable for existing joint-product customers seeking routing, not a public cyber adAPT false-positive desk."
    ],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Record the VirusTotal behavior-report URL, analysis ID, file hash and the exact cyber adAPT finding being disputed.",
          "Customers of the documented Niagara Networks–Cyber adAPT joint solution can ask Niagara Networks support to identify the current product-support contact.",
          "Provide the report reference and ask for routing first. Niagara Networks is a technology partner; no evidence establishes that it controls cyber adAPT's VirusTotal verdicts."
        ],
        "cautions": [
          "The old cyberadapt.com website redirects to an unrelated gambling site; it is excluded from active vendor links.",
          "The archived info@cyberadapt.com and sales@cyberadapt.com addresses belong to that repurposed domain and must not be offered as verified current mailboxes.",
          "Current DNS returns no MX answer for cyberadapt.com. This observation alone does not prove that every mail-delivery mechanism is impossible; the decisive concern is the lack of current vendor ownership evidence.",
          "Niagara Networks is a documented partner, not a confirmed acquirer or replacement owner. Its support route is suitable for existing joint-product customers seeking routing, not a public cyber adAPT false-positive desk."
        ],
        "description": "A March 2025 archive of cyber adAPT's official contact page confirms historical company emails and a phone number. The present domain is unrelated to the vendor, so those details cannot be treated as a verified current appeal channel."
      }
    ],
    "indexable": false,
    "historicalContacts": [
      {
        "type": "email",
        "url": "mailto:info@cyberadapt.com",
        "label": "Historical vendor-published contact — info@cyberadapt.com",
        "scope": "sandbox",
        "source": "https://web.archive.org/web/20250328125817/https://www.cyberadapt.com/contact",
        "sourceCapturedAt": "2025-03-28",
        "currentStatus": "domain-repurposed-current-vendor-control-unconfirmed",
        "useAsActiveContact": false,
        "note": "General company inquiry email in the archived official contact page."
      },
      {
        "type": "email",
        "url": "mailto:sales@cyberadapt.com",
        "label": "Historical vendor-published contact — sales@cyberadapt.com",
        "scope": "sandbox",
        "source": "https://web.archive.org/web/20250328125817/https://www.cyberadapt.com/contact",
        "sourceCapturedAt": "2025-03-28",
        "currentStatus": "domain-repurposed-current-vendor-control-unconfirmed",
        "useAsActiveContact": false,
        "note": "Sales email in the archived official contact page, not a false-positive desk."
      }
    ],
    "historicalPhone": {
      "value": "+1 888.666.3001",
      "source": "https://web.archive.org/web/20250328125817/https://www.cyberadapt.com/contact",
      "sourceCapturedAt": "2025-03-28",
      "currentStatus": "number-ownership-and-activity-unconfirmed",
      "useAsActiveContact": false
    },
    "relatedContacts": [
      {
        "type": "support",
        "url": "https://www.niagaranetworks.com/support",
        "label": "Niagara Networks support — joint-product customer routing only",
        "scope": "sandbox",
        "source": "https://www.niagaranetworks.com/support",
        "relationship": "documented-technology-partner",
        "currentStatus": "official-general-support-route",
        "useAsDirectVendorContact": false,
        "note": "The official joint-solution brief establishes the relationship. Niagara has not been confirmed as cyber adAPT's successor or as able to modify its VirusTotal results."
      }
    ],
    "evidenceNotes": [
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20250328125817/https://www.cyberadapt.com/contact",
        "observation": "The March 28, 2025 capture of the official contact page lists info@cyberadapt.com, sales@cyberadapt.com and +1 888.666.3001. These are historical contact facts, not a live support validation."
      },
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20190328160705/https://www.cyberadapt.com/cyber-adapt-contact-us.html",
        "observation": "The 2019 contact page publishes the same two mailboxes and phone number."
      },
      {
        "level": "current-dns-observation",
        "source": "https://dns.google/resolve?name=cyberadapt.com&type=MX",
        "observation": "The MX query returned Status 0 with no Answer section; A records now resolve to Cloudflare. DNS evidence does not establish present vendor ownership."
      },
      {
        "level": "primary-partner-documentation",
        "source": "https://www.niagaranetworks.com/hubfs/Niagara%20-%20Cyber%20adAPT%20Solution%20Brief.pdf",
        "observation": "Niagara Networks publishes a joint network-security solution with Cyber adAPT. The document is copyright July 2023 and remains listed in Niagara's current resources directory."
      },
      {
        "level": "current-primary-source",
        "source": "https://www.niagaranetworks.com/support",
        "observation": "Niagara offers a Support Center and publicly lists support@niagaranetworks.com. This is partner customer-support evidence only."
      }
    ]
  },
  {
    "slug": "cybercrime",
    "name": "CyberCrime",
    "aliases": [
      "Xylitol",
      "CyberCrime"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.cybercrime-tracker.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:contact@cybercrime-tracker.net",
        "label": "CyberCrime tracker public inquiries",
        "scope": "url",
        "source": "https://www.cybercrime-tracker.net/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.cybercrime-tracker.net/about.php",
        "title": "Official source: www.cybercrime-tracker.net"
      },
      {
        "url": "https://www.cybercrime-tracker.net/",
        "title": "Official source: www.cybercrime-tracker.net"
      }
    ],
    "notes": [
      "The tracker publishes its inquiries mailbox as contact☆cybercrime-tracker.net; the star is an email obfuscation. No dedicated false-positive procedure is stated."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find CyberCrime false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cybereason",
    "name": "Cybereason",
    "aliases": [
      "Cybereason",
      "cybereason"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.cybereason.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vt-feedback@cybereason.com",
        "label": "vt-feedback@cybereason.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Cybereason false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cyble",
    "name": "Cyble",
    "aliases": [
      "Cyble Inc.",
      "cyble",
      "Cyble"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://cyble.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:cyblevt_patnership@cyble.com",
        "label": "VirusTotal-listed Cyble contact",
        "scope": "url",
        "source": "https://virustotal.readme.io/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://virustotal.readme.io/docs/false-positive-contacts",
        "title": "VirusTotal false-positive contacts"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "VirusTotal publishes a dedicated Cyble contact for false-positive reports.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Email the contact exactly as published: cyblevt_patnership@cyble.com.",
          "Include the affected URL or domain and its VirusTotal report link.",
          "Identify Cyble's verdict and explain why it appears incorrect; request a review."
        ],
        "cautions": [
          "The address intentionally preserves VirusTotal's published spelling, including patnership.",
          "A separate vendor-published public URL appeal procedure was not verified."
        ],
        "description": "VirusTotal publishes a dedicated Cyble contact for false-positive reports."
      }
    ],
    "indexable": true
  },
  {
    "slug": "cylance",
    "name": "Cylance",
    "aliases": [
      "cylance"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@arcticwolf.com",
        "label": "Arctic Wolf VirusTotal file contact",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://arcticwolf.com/resources/press-releases/arctic-wolf-and-blackberry-announce-closing-of-acquisition-for-cylance/",
        "title": "Arctic Wolf closes acquisition of Cylance assets"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Arctic Wolf acquired Cylance endpoint-security assets. VirusTotal now lists an Arctic Wolf contact for file-engine issues.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email the Arctic Wolf address listed by VirusTotal and identify Cylance as the historical engine name.",
          "Include the file SHA-256, VirusTotal report URL, detection details and the file's legitimate purpose.",
          "Ask whether the current endpoint team can review the legacy detection."
        ],
        "cautions": [
          "This record preserves the historical Cylance name; it does not assert that Cylance remains a separately active VirusTotal engine.",
          "The listed mailbox has not been delivery-tested."
        ],
        "description": "Arctic Wolf acquired Cylance endpoint-security assets. VirusTotal now lists an Arctic Wolf contact for file-engine issues."
      }
    ],
    "indexable": false
  },
  {
    "slug": "cynet",
    "name": "Cynet",
    "aliases": [
      "Cynet",
      "cynet"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.cynet.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:soc@cynet.com",
        "label": "soc@cynet.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Cynet false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "cyradar",
    "name": "CyRadar",
    "aliases": [
      "CyRadar",
      "cyradar"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.cyradar.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://cyradar.com/reportfp/",
        "label": "CyRadar False Positive Report",
        "scope": "url",
        "source": "https://cyradar.com/reportfp/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://cyradar.com/reportfp/",
        "title": "CyRadar False Positive Report"
      },
      {
        "url": "https://virustotal.readme.io/docs/false-positive-contacts",
        "title": "VirusTotal false-positive reporting guidance"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "CyRadar publishes a dedicated False Positive Report page for domains needing review.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open CyRadar's False Positive Report form.",
          "Enter the required company and email details.",
          "Describe the domain classification you want reviewed, including the affected URL and relevant VirusTotal report link."
        ],
        "cautions": [
          "The public form requests company and email details; telephone is also offered."
        ],
        "description": "CyRadar publishes a dedicated False Positive Report page for domains needing review."
      }
    ],
    "indexable": true
  },
  {
    "slug": "cyren",
    "name": "Cyren",
    "aliases": [
      "cyren"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@varist.com",
        "label": "Varist file-engine support listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://data443.com/faq-data443-acquire-cyren/",
        "title": "Data443 FAQ: Cyren assets and Varist anti-malware services"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Varist acquired Cyren's anti-malware products; the file-engine review route is distinct from Cyren's former URL and email services.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email Varist support and identify the historical Cyren engine name shown by VirusTotal.",
          "Include the file SHA-256, VirusTotal report URL, detection label and evidence of legitimate use.",
          "Ask whether the team can review the legacy engine result; follow its current sample-submission instructions."
        ],
        "cautions": [
          "This is a legacy name. The successor relationship does not guarantee that a historical VirusTotal verdict can still be changed.",
          "The support address is listed in VirusTotal's current contact directory; email delivery has not been tested."
        ],
        "description": "Varist acquired Cyren's anti-malware products; the file-engine review route is distinct from Cyren's former URL and email services."
      }
    ],
    "indexable": false
  },
  {
    "slug": "deep-instinct",
    "name": "Deep Instinct",
    "aliases": [
      "DeepInstinct",
      "deepinstinct",
      "Deep Instinct"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.deepinstinct.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vt-fps-requests@deepinstinct.com",
        "label": "vt-fps-requests@deepinstinct.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Deep Instinct false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "desenmascara-me",
    "name": "desenmascara.me",
    "aliases": [
      "An emiliocasbas.net project",
      "desenmascara.me",
      "desenmascara_me",
      "Desenmascara.me"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://desenmascara.me/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vt-falsepositives@desenmascara.me",
        "label": "vt-falsepositives@desenmascara.me",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find desenmascara.me false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "ditekshen",
    "name": "ditekshen",
    "aliases": [
      "diˈtekSHən"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/ditekshen/detection",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/ditekshen/detection",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find ditekshen false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "dns-over-http-detection",
    "name": "DNS over HTTP detection",
    "aliases": [
      "DNS over HTTP detection"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/jpgpi250/piholemanual/tree/master/DOH",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/jpgpi250/piholemanual/tree/master/DOH",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find DNS over HTTP detection false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "dns8",
    "name": "DNS8",
    "aliases": [
      "Layer8",
      "dns8",
      "DNS8"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.layer8.pt/dns8",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:dns8@layer8.pt",
        "label": "dns8@layer8.pt",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find DNS8 false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "docguard",
    "name": "Docguard",
    "aliases": [
      "Docguard"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://www.docguard.io/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.docguard.io/#contact",
        "label": "Docguard general contact form",
        "scope": "sandbox",
        "source": "https://www.docguard.io/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.docguard.io/",
        "title": "Docguard general contact form"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Docguard publishes a contact form on its official website. Use Other to ask for a review of a Docguard analysis.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for Docguard's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "Choose Other in the interest selector and describe the disputed result in the message.",
          "The public analysis upload is separate from a support request; confirm sample handling before sending confidential material."
        ],
        "description": "Docguard publishes a contact form on its official website. Use Other to ask for a review of a Docguard analysis."
      }
    ],
    "indexable": true
  },
  {
    "slug": "dr-web",
    "name": "Dr.Web",
    "aliases": [
      "Doctor Web, Ltd.",
      "DrWeb",
      "Dr.Web Link Scanner",
      "Dr. Web VxCube",
      "Dr Web",
      "dr_web",
      "drweb"
    ],
    "scopes": [
      "file",
      "sandbox",
      "url"
    ],
    "website": "http://www.drweb.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://vms.drweb.com/sendvirus/",
        "label": "Dr.Web laboratory submission",
        "source": "https://vms.drweb.com/sendvirus/",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:vms@drweb.com",
        "label": "vms@drweb.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://vms.drweb.com/sendvirus/",
        "title": "Send a suspicious file/link for analysis"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Behavioral analysis / sandbox products",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Dr.Web false-positive review channels for files and sandbox and websites / URLs. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Use the file section of the laboratory submission form.",
          "Attach the sample and select False positive as the request category.",
          "Enter your email, describe the mistaken detection, complete the displayed verification and send.",
          "Keep the request ID from the confirmation email; replies to that email can continue the same request."
        ],
        "cautions": [
          "The web form accepts attachments up to 50 MB and offers a download-link option for larger files.",
          "Doctor Web asks for one file per request unless the files are related, and does not promise a regulated response time."
        ],
        "description": "Doctor Web's laboratory submission form has a False positive category for files."
      },
      {
        "scope": "sandbox",
        "steps": [
          "Record the report URL, sandbox name, and specific observed behavior.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      },
      {
        "scope": "url",
        "steps": [
          "Record the exact affected URL or domain and detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "elastic",
    "name": "Elastic",
    "aliases": [
      "Elastic",
      "elastic"
    ],
    "scopes": [
      "file",
      "rules"
    ],
    "website": "https://www.elastic.co/",
    "contacts": [
      {
        "type": "form",
        "url": "https://docs.google.com/forms/d/e/1FAIpQLSfKZOPSPcucmgNR9_j316JnG_qYbJBpti5JSsNxQNQtTHjsxw/viewform",
        "label": "Elastic false-positive submission",
        "source": "https://discuss.elastic.co/t/submitting-false-positives/232322",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "form",
        "url": "https://docs.google.com/forms/d/e/1FAIpQLSfKZOPSPcucmgNR9_j316JnG_qYbJBpti5JSsNxQNQtTHjsxw/viewform",
        "label": "Elastic False Positive Submission Form",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "form",
        "url": "https://discuss.elastic.co/t/submitting-false-positives/232322",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "repository",
        "url": "https://github.com/elastic/protections-artifacts",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://discuss.elastic.co/t/submitting-false-positives/232322",
        "title": "Submitting False Positives"
      },
      {
        "url": "https://docs.google.com/forms/d/e/1FAIpQLSfKZOPSPcucmgNR9_j316JnG_qYbJBpti5JSsNxQNQtTHjsxw/viewform",
        "title": "Elastic False Positive Submission"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "YARA rule repositories",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Elastic false-positive review channels for files and rules. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "If you are an Elastic support customer, open the request through your existing support channel.",
          "Otherwise, complete the community form with the file's SHA-256, VirusTotal sample URL, company or software name, and contact name and email.",
          "Add the software website, filename and useful context where available, then submit the form."
        ],
        "cautions": [
          "Elastic no longer reviews email submissions sent after June 5, 2024.",
          "The form is for community submissions and states that a report does not guarantee a verdict change."
        ],
        "description": "Elastic accepts community false-positive reports through a dedicated form; existing customers should use their normal support process."
      },
      {
        "scope": "rules",
        "steps": [
          "Record the rule identifier, matched indicator and the report URL.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "emerging-threats",
    "name": "Emerging Threats",
    "aliases": [
      "Proofpoint",
      "emergingthreats",
      "EmergingThreats",
      "Emerging Threats"
    ],
    "scopes": [
      "rules",
      "url"
    ],
    "website": "https://rules.emergingthreats.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@emergingthreats.net",
        "label": "support@emergingthreats.net",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Emerging Threats false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "emsisoft",
    "name": "Emsisoft",
    "aliases": [
      "Emsisoft Ltd",
      "emsisoft",
      "Emsisoft"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.emsisoft.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.emsisoft.com/en/help/contact/?c=submit",
        "label": "Emsisoft false-positive contact form",
        "source": "https://www.emsisoft.com/en/help/contact/?c=submit",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:submit@emsisoft.com",
        "label": "submit@emsisoft.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "email",
        "url": "mailto:fp@emsisoft.com",
        "label": "fp@emsisoft.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "support",
        "url": "https://www.emsisoft.com/en/support/contact/",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.emsisoft.com/en/help/contact/?c=submit",
        "title": "Emsisoft Contact Us"
      },
      {
        "url": "https://www.emsisoft.com/en/help/1720/why-did-an-emsisoft-product-detect-an-innocent-file-as-malware-2/",
        "title": "False positives: Why did Emsisoft quarantine a safe program?"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Emsisoft false-positive review channels for files and websites / URLs. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open the contact form and select False positive.",
          "Choose the affected product, provide your name and email, and explain the detection in the subject and message.",
          "Attach the file and submit. Alternatively, select the quarantined file in the local Emsisoft app and choose False Detection."
        ],
        "cautions": [
          "The web form displays a 200 MB attachment limit.",
          "Emsisoft asks users to avoid sending the same request in multiple categories."
        ],
        "description": "Emsisoft offers a false-positive category in its contact form and a False Detection option in the local product."
      },
      {
        "scope": "url",
        "steps": [
          "Record the exact affected URL or domain and detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "endgame",
    "name": "Endgame",
    "aliases": [
      "endgame"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "form",
        "url": "https://docs.google.com/forms/d/e/1FAIpQLSfKZOPSPcucmgNR9_j316JnG_qYbJBpti5JSsNxQNQtTHjsxw/viewform",
        "label": "Elastic false-positive submission",
        "source": "https://discuss.elastic.co/t/submitting-false-positives/232322",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://www.elastic.co/about/press/elastic-completes-the-acquisition-of-endgame-a-leader-in-endpoint-protection",
        "title": "Elastic completes acquisition of Endgame"
      },
      {
        "url": "https://discuss.elastic.co/t/submitting-false-positives/232322",
        "title": "Submitting False Positives"
      },
      {
        "url": "https://docs.google.com/forms/d/e/1FAIpQLSfKZOPSPcucmgNR9_j316JnG_qYbJBpti5JSsNxQNQtTHjsxw/viewform",
        "title": "Elastic False Positive Submission"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Elastic acquired Endgame. Use Elastic's current review channel to ask about a historical Endgame file detection.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "State that the disputed VirusTotal result uses the historical Endgame name.",
          "If you are an Elastic support customer, open the request through your existing support channel.",
          "Otherwise, complete the community form with the file's SHA-256, VirusTotal sample URL, company or software name, and contact name and email.",
          "Add the software website, filename and useful context where available, then submit the form."
        ],
        "cautions": [
          "This is a legacy engine name. Availability of a historical verdict review must be confirmed with the current vendor.",
          "Elastic no longer reviews email submissions sent after June 5, 2024.",
          "The form is for community submissions and states that a report does not guarantee a verdict change."
        ],
        "description": "Elastic acquired Endgame. Use Elastic's current review channel to ask about a historical Endgame file detection."
      }
    ],
    "indexable": false
  },
  {
    "slug": "ermes",
    "name": "Ermes",
    "aliases": [
      "ermes",
      "Ermes"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support-vt@ermes.company",
        "label": "support-vt@ermes.company",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Ermes false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "escan",
    "name": "eScan",
    "aliases": [
      "Microworld",
      "escan",
      "microworld_escan"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.escanav.com/english/index-new.asp",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:samples@escanav.com",
        "label": "samples@escanav.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find eScan false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "eset",
    "name": "ESET",
    "aliases": [
      "Eset Software",
      "ESET-NOD32",
      "eset",
      "eset_nod32",
      "nod32",
      "ESET"
    ],
    "scopes": [
      "file",
      "rules",
      "url"
    ],
    "website": "http://www.eset.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:samples@eset.com",
        "label": "Email ESET Research Lab",
        "scope": "url",
        "source": "https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://support.eset.com/kb141/?page=content&id=SOLN141",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "repository",
        "url": "https://github.com/eset/malware-ioc",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://support.eset.com/en/kb141-submit-a-virus-website-or-potential-false-positive-sample-to-the-eset-lab",
        "title": "ESET KB141: submit a website or false positive"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "YARA rule repositories",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "ESET false-positive review channels for websites / URLs and files and rules. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Send a plain-text email to samples@eset.com with a subject beginning Domain whitelist followed by the blocked domain.",
          "Put the complete blocked URL in the message, explain why the detection appears incorrect, and include relevant site or software context.",
          "Attach a screenshot of the blocking notification when available."
        ],
        "cautions": [
          "ESET asks for no unrelated links, email addresses, inline images, or email signature/footer in the message.",
          "Web Control or Parental Control category errors have a separate form linked from the same support article."
        ],
        "description": "ESET Research Lab accepts blocked-website and website false-positive reports by email."
      },
      {
        "scope": "file",
        "steps": [
          "Record the file SHA-256, filename and exact detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      },
      {
        "scope": "rules",
        "steps": [
          "Record the rule identifier, matched indicator and the report URL.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "estsecurity",
    "name": "ESTsecurity",
    "aliases": [
      "ALYac",
      "ESTsecurity-Threat Inside",
      "estsecurity",
      "alyac",
      "Alyac (Estsoft)",
      "ESTsecurity"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.alyac.com/en/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:esrc@estsecurity.com",
        "label": "esrc@estsecurity.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find ESTsecurity false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "f-prot",
    "name": "F-Prot",
    "aliases": [
      "f_prot",
      "F-Prot"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:viruslab@f-prot.com",
        "label": "viruslab@f-prot.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find F-Prot false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "f-secure",
    "name": "F-Secure",
    "aliases": [
      "F-Secure",
      "F-Secure (consumer)",
      "f_secure",
      "F-Secure/WithSecure",
      "WithSecure/F-Secure"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.f-secure.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.f-secure.com/en/support/submit-a-sample",
        "label": "F-Secure sample submission",
        "source": "https://www.f-secure.com/en/support/submit-a-sample",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.f-secure.com/en/support/submit-a-sample",
        "title": "F-Secure Submit a sample"
      }
    ],
    "notes": [
      "F-Secure consumer products and WithSecure business products have separate review channels."
    ],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "F-Secure provides its own public sample-submission form for incorrectly detected files.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open Submit a sample and choose File sample.",
          "Select the affected file; the form recommends a ZIP archive protected with the password infected.",
          "Choose Yes to provide more details, then select the product and problem and supply a subject, description and contact information.",
          "Continue through the form to submit the sample."
        ],
        "cautions": [
          "F-Secure and WithSecure now publish different submission workflows. Use the vendor and product that actually produced the detection.",
          "Submit only samples you are authorized to share."
        ],
        "description": "F-Secure provides its own public sample-submission form for incorrectly detected files."
      }
    ],
    "indexable": true
  },
  {
    "slug": "florian-roth",
    "name": "Florian Roth",
    "aliases": [
      "Neo23x0",
      "Florian Roth"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/Neo23x0/signature-base",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/Neo23x0/signature-base",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Florian Roth false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "forcepoint-threatseeker",
    "name": "Forcepoint ThreatSeeker",
    "aliases": [
      "Forcepoint",
      "forcepoint_threatseeker",
      "Forcepoint ThreatSeeker"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.forcepoint.com/forcepoint-threatseeker-intelligence",
    "contacts": [
      {
        "type": "form",
        "url": "https://csi.forcepoint.com/",
        "label": "Analyze and suggest a category",
        "scope": "url",
        "source": "https://www.forcepoint.com/product-security-report-issue",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://support.forcepoint.com/contactsupport",
        "label": "Forcepoint technical support",
        "scope": "url",
        "source": "https://www.forcepoint.com/product-security-report-issue",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.forcepoint.com/product-security-report-issue",
        "title": "Forcepoint website categorization and support routing"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Forcepoint directs website-category disputes to ACE CSI Insight or technical support.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Analyze the affected website in ACE CSI Insight.",
          "Use the option to suggest a new categorization and provide the category you believe is appropriate.",
          "If the issue needs support, open a case with the affected URL and the relevant detection details."
        ],
        "cautions": [
          "Forcepoint's product-vulnerability reporting address is not the category-review channel."
        ],
        "description": "Forcepoint directs website-category disputes to ACE CSI Insight or technical support."
      }
    ],
    "indexable": true
  },
  {
    "slug": "fortinet",
    "name": "Fortinet",
    "aliases": [
      "FortiGuard Web Filtering",
      "fortinet",
      "Fortinet"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.fortinet.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.fortiguard.com/faq/malurl",
        "label": "Malicious URL review",
        "scope": "url",
        "source": "https://www.fortiguard.com/faq",
        "verification": "vendor-confirmed"
      },
      {
        "type": "form",
        "url": "https://www.fortiguard.com/webfilter",
        "label": "Web Filter Lookup and review",
        "scope": "url",
        "source": "https://community.fortinet.com/fortigate-3/technical-note-fortigate-fortiguard-webfilter-re-categorization-97756",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "http://www.fortinet.com/support/contact_support.html",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.fortiguard.com/faq",
        "title": "FortiGuard frequently asked questions"
      },
      {
        "url": "https://community.fortinet.com/fortigate-3/technical-note-fortigate-fortiguard-webfilter-re-categorization-97756",
        "title": "FortiGuard webfilter re-categorization"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Fortinet false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "For a malicious URL verdict, open the Malicious URL Database form and provide the affected URL and the relevant detection details.",
          "For a category error, look up the address in FortiGuard Web Filter Lookup, choose Request a Review, and suggest the appropriate category.",
          "Include a screenshot of the block message when available."
        ],
        "cautions": [
          "Use the malicious-URL route for a security verdict and the category-review route for an incorrect web category."
        ],
        "description": "FortiGuard offers separate review routes for malicious URL database entries and web-filter categories."
      },
      {
        "scope": "file",
        "steps": [
          "Record the file SHA-256, filename and exact detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "frank-boldewin",
    "name": "Frank Boldewin",
    "aliases": [
      "Frank Boldewin"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/fboldewin/YARA-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/fboldewin/YARA-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Frank Boldewin false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "g-data",
    "name": "G DATA",
    "aliases": [
      "G DATA Software",
      "GData",
      "G-Data",
      "G Data",
      "g_data",
      "gdata"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.gdata.de/",
    "contacts": [
      {
        "type": "form",
        "url": "https://su.gdatasoftware.com/sample-submission",
        "label": "G DATA file sample upload",
        "source": "https://www.gdata.de/help-en/general/GeneralInformation/submitFileAppURL/",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "form",
        "url": "https://www.gdata.de/help/en/general/GeneralInformation/submitFileAppURL/",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.gdata.de/help-en/general/GeneralInformation/submitFileAppURL/",
        "title": "Submit a file, app, or URL for review"
      },
      {
        "url": "https://www.gdata.de/help-en/consumer/FAQ/contactUsFAQ/",
        "title": "How to contact G DATA"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "G DATA false-positive review channels for files and websites / URLs. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open the sample-upload service and review the submission and privacy terms.",
          "Choose the incorrectly detected file and supply the requested detection details.",
          "State that the file is believed to be a false positive and explain its legitimate function, then complete the form."
        ],
        "cautions": [
          "The upload service requests consent before continuing.",
          "G DATA says it cannot review files or apps sent through other channels for security reasons."
        ],
        "description": "G DATA's documented review page links to its file sample-upload service."
      },
      {
        "scope": "url",
        "steps": [
          "Record the exact affected URL or domain and detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "google-cloud-threat-intelligence",
    "name": "Google Cloud Threat Intelligence",
    "aliases": [
      "GCTI",
      "Google Cloud Threat Intelligence"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://www.virustotal.com/gui/user/gcti",
    "contacts": [
      {
        "type": "support",
        "url": "https://docs.cloud.google.com/support/docs/integrations",
        "label": "Google Threat Intelligence customer-support instructions",
        "scope": "rules",
        "source": "https://docs.cloud.google.com/support/docs/integrations",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.cloud.google.com/support/docs/integrations",
        "title": "Google Cloud Customer Care transitions: Google Threat Intelligence"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Google Threat Intelligence customer support is handled through Google Cloud Customer Care. A support case can request routing of a disputed Google-authored rule match.",
    "cautions": [],
    "guides": [
      {
        "scope": "rules",
        "steps": [
          "Follow the Google Threat Intelligence onboarding instructions for Cloud Customer Care and sign in with your support-enabled organization account.",
          "Create a technical support case for Google Threat Intelligence, naming the GCTI rule author, rule name or ID, VirusTotal report URL and disputed match.",
          "Explain the legitimate behavior and ask the support team to route the report to the rule owner."
        ],
        "cautions": [
          "This is a customer technical-support route, not a publicly confirmed GCTI false-positive form. A Google Threat Intelligence subscription and configured support access may be required.",
          "Google states that GTI customer support moved from legacy VirusTotal channels to the Google Cloud console on December 2, 2025.",
          "Do not confuse a GCTI rule match with the Google antivirus file engine or Google Safe Browsing."
        ],
        "description": "Google Threat Intelligence customer support is handled through Google Cloud Customer Care. A support case can request routing of a disputed Google-authored rule match."
      }
    ],
    "indexable": true
  },
  {
    "slug": "google-file-scanner",
    "name": "Google File Scanner",
    "aliases": [
      "Google",
      "google",
      "Google (File Scanner)"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.google.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:google-at-virustotal@google.com",
        "label": "google-at-virustotal@google.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Google File Scanner false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "google-safe-browsing",
    "name": "Google Safe Browsing",
    "aliases": [
      "Google Safebrowsing",
      "Google",
      "google_safebrowsing",
      "Google Safe Browsing / Web Risk"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://code.google.com/apis/safebrowsing/",
    "contacts": [
      {
        "type": "form",
        "url": "https://safebrowsing.google.com/safebrowsing/report_error/",
        "label": "Report an incorrect phishing warning",
        "scope": "url",
        "source": "https://support.google.com/webmasters/answer/6347750?hl=en-EN",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://search.google.com/search-console/security-issues",
        "label": "Search Console Security Issues",
        "scope": "url",
        "source": "https://support.google.com/webmasters/answer/9044101?hl=en-GW",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://support.google.com/webmasters/answer/6347750?hl=en-EN",
        "title": "Why is my site labeled as dangerous in Google Search?"
      },
      {
        "url": "https://support.google.com/webmasters/answer/9044101?hl=en-GW",
        "title": "Security issues report"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Google provides a public incorrect-warning report and a Search Console security-review process for website owners.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "If a page is incorrectly identified as phishing or deceptive, submit it through Google's incorrect-warning form.",
          "For a site you own, verify it in Search Console and inspect the Security Issues report.",
          "Resolve the listed issues, select Request a review, and explain the fixes for each issue type."
        ],
        "cautions": [
          "Google Safe Browsing is the URL/domain protection service. A Google file-scanner verdict in VirusTotal is a separate indicator type.",
          "Search Console Manual Actions and Security Issues use different review processes."
        ],
        "description": "Google provides a public incorrect-warning report and a Search Console security-review process for website owners."
      }
    ],
    "indexable": true
  },
  {
    "slug": "greensnow",
    "name": "GreenSnow",
    "aliases": [
      "greensnow",
      "GreenSnow"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "support",
        "url": "https://greensnow.co/contact",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find GreenSnow false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "gridinsoft",
    "name": "Gridinsoft",
    "aliases": [
      "Gridinsoft (no cloud)",
      "gridinsoft",
      "Gridinsoft"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "https://gridinsoft.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://portal.gridinsoft.com/false-positive",
        "label": "Website and domain false-positive form",
        "scope": "url",
        "source": "https://support.gridinsoft.com/portal/en/kb/articles/i-think-this-is-a-false-positive-what-should-i-do",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:virus@gridinsoft.com",
        "label": "virus@gridinsoft.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://portal.gridinsoft.com/false-positive",
        "title": "Gridinsoft False Positive Request"
      },
      {
        "url": "https://support.gridinsoft.com/portal/en/kb/articles/i-think-this-is-a-false-positive-what-should-i-do",
        "title": "Gridinsoft false-positive reporting guidance"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Gridinsoft false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open the False Positive Request form and indicate whether you represent the domain or are a visitor reporting an error.",
          "Enter your contact details and the affected domain or hostname.",
          "Open the confirmation link sent by email to place the request in the review queue. Provide the disputed classification and cleanup evidence in the review workflow."
        ],
        "cautions": [
          "Website reputation cases use the Portal, rather than the file/app Support ticket workflow.",
          "Remove passwords, tokens, and private query data from evidence URLs.",
          "Direct owner/operator review requests are free; Gridinsoft publishes separate terms for paid commercial intermediaries."
        ],
        "description": "Gridinsoft has a dedicated website and domain false-positive portal with email confirmation."
      },
      {
        "scope": "file",
        "steps": [
          "Record the file SHA-256, filename and exact detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "guardbot-priente",
    "name": "Guardbot / Priente",
    "aliases": [
      "Guardbot",
      "Priente"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://prientegroup.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:info@priente.com",
        "label": "Priente general contact",
        "scope": "file",
        "source": "https://prientegroup.com/iletisim",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://prientegroup.com/iletisim",
        "title": "Priente general contact"
      },
      {
        "url": "https://prientegroup.com/assets/index-jXhdI4v3.js",
        "title": "Official Priente website contact content"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "The official Priente website publishes a general contact for inquiries about its products, including routing a Guardbot detection dispute.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Use the official general contact below and ask for the team responsible for Guardbot / Priente's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, exact detection label and software publisher. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed."
        ],
        "description": "The official Priente website publishes a general contact for inquiries about its products, including routing a Guardbot detection dispute."
      }
    ],
    "indexable": true
  },
  {
    "slug": "guardpot",
    "name": "Guardpot",
    "aliases": [
      "Guardpot"
    ],
    "scopes": [],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@guardpot.com",
        "label": "virustotal@guardpot.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed only in the VirusTotal false-positive contacts table in this inventory. Current engine participation and indicator scope have not been established; the contact may be historical.",
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "False positive contacts"
    ],
    "status": "contact-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Guardpot false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "hauri",
    "name": "Hauri",
    "aliases": [
      "ViRobot",
      "virobot",
      "Hauri"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.hauri.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:viruslab@hauri.co.kr",
        "label": "viruslab@hauri.co.kr",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Hauri false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "heimdal-security",
    "name": "Heimdal Security",
    "aliases": [
      "heimdal_security",
      "Heimdal",
      "Heimdal Security"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://heimdalsecurity.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:report-vt@heimdalsecurity.com",
        "label": "report-vt@heimdalsecurity.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Heimdal Security false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "hoplite-industries",
    "name": "Hoplite Industries",
    "aliases": [
      "Hoplite Industries"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.hopliteindustries.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vt-info@hopliteindustries.com",
        "label": "vt-info@hopliteindustries.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Hoplite Industries false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "hunt-io-intelligence",
    "name": "Hunt.io Intelligence",
    "aliases": [
      "Hunt.io Intelligence"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://hunt.io/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:k.lo@hunt.io",
        "label": "k.lo@hunt.io",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Hunt.io Intelligence false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "huorong",
    "name": "Huorong",
    "aliases": [
      "Huorong",
      "huorong"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.huorong.cn/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:seclab@huorong.cn",
        "label": "seclab@huorong.cn",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Huorong false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "ikarus",
    "name": "IKARUS",
    "aliases": [
      "IKARUS Security Software",
      "Ikarus",
      "ikarus"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.ikarus.at/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:fp@ikarus.at",
        "label": "IKARUS false-positive email (VT-listed)",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://www.ikarussecurity.com/en/managed-it-ot-security-solutions/ikarus-anti-virus/faqs-ikarus-anti-virus/",
        "label": "IKARUS submission instructions",
        "source": "https://www.ikarussecurity.com/en/managed-it-ot-security-solutions/ikarus-anti-virus/faqs-ikarus-anti-virus/",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      },
      {
        "url": "https://www.ikarussecurity.com/en/managed-it-ot-security-solutions/ikarus-anti-virus/faqs-ikarus-anti-virus/",
        "title": "IKARUS anti.virus FAQs"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "IKARUS documents in-product false-positive submission; VirusTotal also lists an email for its engine.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "In IKARUS anti.virus, open Quarantine, right-click the affected file and choose Send to IKARUS.",
          "For a VirusTotal-only detection, contact the listed false-positive email with the report URL, exact detection and file hash.",
          "Describe the file's intended behavior and provide a sample if requested by the analysts."
        ],
        "cautions": [
          "The quarantine workflow is confirmed by IKARUS; fp@ikarus.at is listed by VirusTotal and was not tested by email."
        ],
        "description": "IKARUS documents in-product false-positive submission; VirusTotal also lists an email for its engine."
      }
    ],
    "indexable": true
  },
  {
    "slug": "inca-tachyon",
    "name": "INCA / TACHYON",
    "aliases": [
      "INCA Internet",
      "TACHYON",
      "nprotect",
      "tachyon",
      "Inca (Tachyon) (nProtect)"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://tachyonlab.com/en/index.html",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virus_info@inca.co.kr",
        "label": "virus_info@inca.co.kr",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find INCA / TACHYON false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "inquest",
    "name": "InQuest",
    "aliases": [
      "InQuest"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/InQuest/yara-rules-vt",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/InQuest/yara-rules-vt",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find InQuest false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "intezer",
    "name": "Intezer",
    "aliases": [
      "Intezer"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/intezer/yara-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/intezer/yara-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Intezer false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "invincea",
    "name": "Invincea",
    "aliases": [
      "invincea"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:samples@sophos.com",
        "label": "SophosLabs sample-review contact",
        "scope": "file",
        "source": "https://community.sophos.com/sophos-endpoint/f/discussions/100700/sophos-invincea-ml-engine-update-frequency",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://community.sophos.com/sophos-endpoint/f/discussions/100700/sophos-invincea-ml-engine-update-frequency",
        "title": "Sophos staff guidance for Invincea ML-engine detections"
      },
      {
        "url": "https://www.sophos.com/en-us/blog/sandboxie-is-now-an-open-source-tool",
        "title": "Sophos confirms Invincea acquisition in 2017"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Sophos acquired Invincea. A Sophos staff response about the Invincea engine directs samples or hashes to SophosLabs.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email samples@sophos.com and identify the historical Invincea engine name in your review request.",
          "Include the VirusTotal report link, SHA-256, exact detection and a short explanation of the file's intended use.",
          "Ask SophosLabs to confirm the current submission process and whether the historical result can be reviewed."
        ],
        "cautions": [
          "The engine name is historical. The Invincea-specific staff guidance is older; the same mailbox remains listed by VirusTotal.",
          "Do not assume a legacy report can be changed solely because the current vendor accepts samples."
        ],
        "description": "Sophos acquired Invincea. A Sophos staff response about the Invincea engine directs samples or hashes to SophosLabs."
      }
    ],
    "indexable": false
  },
  {
    "slug": "ipsum",
    "name": "IPsum",
    "aliases": [
      "IPSum",
      "ipsum",
      "IPsum"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://github.com/stamparm/ipsum",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/stamparm/ipsum",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find IPsum false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "jiangmin",
    "name": "Jiangmin",
    "aliases": [
      "Jiangmin",
      "jiangmin"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.jiangmin.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@jiangmin.com",
        "label": "support@jiangmin.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      },
      {
        "type": "email",
        "url": "mailto:shaojia@jiangmin.com",
        "label": "shaojia@jiangmin.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Jiangmin false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "joe-security",
    "name": "Joe Security",
    "aliases": [
      "Joe Security"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/joesecurity/sigma-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/joesecurity/sigma-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced Sigma Rules"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Joe Security false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "johannes-bader",
    "name": "Johannes Bader",
    "aliases": [
      "baderj",
      "Johannes Bader"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/baderj/yara",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/baderj/yara",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Johannes Bader false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "jpcert-coordination-center",
    "name": "JPCERT Coordination Center",
    "aliases": [
      "JPCERT Coordination Center"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/JPCERTCC/MalConfScan",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/JPCERTCC/MalConfScan",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find JPCERT Coordination Center false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "juniper-networks",
    "name": "Juniper Networks",
    "aliases": [
      "Juniper Networks",
      "juniper_networks"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.juniper.net/",
    "contacts": [
      {
        "type": "support",
        "url": "https://www.juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-user-guide/topics/concept/atp-cloud-threat-sources-details.html",
        "label": "Juniper ATP false-positive reporting instructions",
        "scope": "url",
        "source": "https://www.juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-user-guide/topics/concept/atp-cloud-threat-sources-details.html",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://www.juniper.net/documentation/us/en/software/atp-cloud/atp-cloud-user-guide/topics/concept/atp-cloud-threat-sources-details.html",
        "title": "Official source: www.juniper.net"
      }
    ],
    "notes": [
      "The documented workflow is inside the Juniper ATP product and requires access. It permits reporting DNS and C&C indicators. A separate public VirusTotal appeal form was not verified."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "In Juniper ATP, open the relevant threat source details.",
      "Use Select Option → Report as False Positive, and describe the suspected error with the indicator and VirusTotal report.",
      "Juniper investigates the report; submitting it does not immediately change the verdict."
    ],
    "description": "Find Juniper Networks false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "k7-computing",
    "name": "K7 Computing",
    "aliases": [
      "K7AntiVirus",
      "K7GW",
      "k7antivirus",
      "k7gw",
      "K7",
      "K7 Computing"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.k7computing.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:reportfp@labs.k7computing.com",
        "label": "reportfp@labs.k7computing.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "email",
        "url": "mailto:k7viruslab@labs.k7computing.com",
        "label": "k7viruslab@labs.k7computing.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find K7 Computing false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "kaspersky",
    "name": "Kaspersky",
    "aliases": [
      "Kaspersky Lab",
      "Kaspersky URL advisor",
      "kaspersky",
      "Kaspersky"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.kaspersky.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://opentip.kaspersky.com/",
        "label": "Look up and request reanalysis",
        "scope": "url",
        "source": "https://support.kaspersky.com/common/error/other/1870",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:newvirus@kaspersky.com",
        "label": "newvirus@kaspersky.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://support.kaspersky.com/common/error/other/1870",
        "title": "False detections by Kaspersky applications: what to do"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Kaspersky false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Check the affected domain or URL in Kaspersky Threat Intelligence Portal.",
          "On the results page, select Submit to reanalyze.",
          "Enter a contact email and explain how you obtained the link, the expected content, and why the verdict appears incorrect; then submit."
        ],
        "cautions": [
          "If the issue persists in a Kaspersky product, include the product/version, database timestamp, detection text, and URL when contacting the appropriate home or business support team."
        ],
        "description": "Kaspersky routes disputed domain and URL verdicts through its Threat Intelligence Portal for reanalysis."
      },
      {
        "scope": "file",
        "steps": [
          "Record the file SHA-256, filename and exact detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "kingsoft",
    "name": "Kingsoft",
    "aliases": [
      "Kingsoft",
      "kingsoft"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.kingsoft.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:ti@mingting.cn",
        "label": "ti@mingting.cn",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Kingsoft false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "lastline",
    "name": "LastLine",
    "aliases": [
      "LastLine"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://www.lastline.com/",
    "contacts": [
      {
        "type": "support",
        "url": "https://knowledge.broadcom.com/external/article/337698/how-to-provide-a-malware-sampleanalysis.html",
        "label": "NSX detection-review submission instructions",
        "scope": "sandbox",
        "source": "https://knowledge.broadcom.com/external/article/337698/how-to-provide-a-malware-sampleanalysis.html",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://knowledge.broadcom.com/external/article?articleId=144456",
        "label": "Broadcom case creation instructions",
        "scope": "sandbox",
        "source": "https://knowledge.broadcom.com/external/article?articleId=144456",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://knowledge.broadcom.com/external/article/337698/how-to-provide-a-malware-sampleanalysis.html",
        "title": "How to provide a malware sample to VMware support"
      },
      {
        "url": "https://knowledge.broadcom.com/external/article/323928/nsx-network-detection-and-response-snif.html",
        "title": "Broadcom identifies NSX NDR as formerly Lastline"
      },
      {
        "url": "https://knowledge.broadcom.com/external/article?articleId=144456",
        "title": "Broadcom case management FAQ"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Lastline became VMware NSX Network Detection and Response. Broadcom's current support documentation describes how customers request detection reviews.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Open a VMware NSX/vDefend Network Detection and Response technical support case through Broadcom support and identify the historical LastLine report.",
          "If the file already exists in VirusTotal, provide its hash and report link; Broadcom says its support team can obtain known samples from VirusTotal.",
          "If support needs the sample, place it in an encrypted ZIP, share the password with the engineer and attach it to the support case.",
          "Explain why the verdict or behavior finding is a false positive."
        ],
        "cautions": [
          "This is a customer support process; a valid Broadcom Support Site ID is required to create cases.",
          "The successor support route does not guarantee that every historical LastLine report can be revised."
        ],
        "description": "Lastline became VMware NSX Network Detection and Response. Broadcom's current support documentation describes how customers request detection reviews."
      }
    ],
    "indexable": true
  },
  {
    "slug": "lavasoft-ad-aware",
    "name": "Lavasoft / Ad-Aware",
    "aliases": [
      "Lavasoft",
      "Ad-Aware",
      "ad_aware"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.lavasoft.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.adaware.com/contact/",
        "label": "Adaware general contact form",
        "scope": "file",
        "source": "https://www.adaware.com/contact/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://www.adaware.com/contact/",
        "title": "Adaware general contact form"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Lavasoft's former website redirects to Adaware. Adaware offers a contact form for routing questions about legacy Ad-Aware detections.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Use the official general contact below and ask for the team responsible for Lavasoft / Ad-Aware's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, exact detection label and software publisher. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "Provide your name, email and message in the official contact form.",
          "A current dedicated false-positive process for historical Ad-Aware engine results was not confirmed."
        ],
        "description": "Lavasoft's former website redirects to Adaware. Adaware offers a contact form for routing questions about legacy Ad-Aware detections."
      }
    ],
    "indexable": true
  },
  {
    "slug": "levelblue",
    "name": "LevelBlue",
    "aliases": [
      "levelblue",
      "Trustwave (now LevelBlue)",
      "LevelBlue"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://support.levelblue.com/virustotal-detection-review/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:LevelBlueVirusTotalEscalations@levelblue.com",
        "label": "LevelBlueVirusTotalEscalations@levelblue.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find LevelBlue false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "lionic",
    "name": "Lionic",
    "aliases": [
      "Lionic",
      "lionic"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.lionic.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@lionic.com",
        "label": "support@lionic.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "email",
        "url": "mailto:support@lionic.com",
        "label": "Lionic support email (VT-listed)",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      },
      {
        "type": "support",
        "url": "https://www.lionic.com/supports/report-false-positive/",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "support",
        "url": "https://www.lionic.com/supports/report-false-positive/",
        "label": "Lionic false-positive page",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      },
      {
        "url": "https://www.lionic.com/supports/report-false-positive/",
        "title": "Lionic Report False Positive"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Lionic false-positive review channels for files and websites / URLs. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open Lionic's Report False Positive page.",
          "If no submission form is available, use the support email listed by VirusTotal.",
          "Include the VirusTotal report URL, detection label, file hash and an explanation of the file's legitimate purpose."
        ],
        "cautions": [
          "The official false-positive page was reachable but exposed no submission form in the public page content checked.",
          "The support email is listed by VirusTotal; email delivery and response were not tested."
        ],
        "description": "VirusTotal lists Lionic's false-positive page and support email for requesting a review."
      },
      {
        "scope": "url",
        "steps": [
          "Record the exact affected URL or domain and detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "lisandro-ubiedo",
    "name": "Lisandro Ubiedo",
    "aliases": [
      "Lisandro Ubiedo"
    ],
    "scopes": [
      "rules"
    ],
    "website": "http://github.com/lubiedo/threatintel",
    "contacts": [
      {
        "type": "repository",
        "url": "http://github.com/lubiedo/threatintel",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Lisandro Ubiedo false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "luke-acha",
    "name": "Luke Acha",
    "aliases": [
      "Luke Acha"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/securitymagic/yara",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/securitymagic/yara",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Luke Acha false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "lumu",
    "name": "Lumu",
    "aliases": [
      "Lumu Technologies",
      "lumu",
      "Lumu"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://lumu.io/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vt@lumu.io",
        "label": "vt@lumu.io",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Lumu false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "malbeacon",
    "name": "Malbeacon",
    "aliases": [
      "Malbeacon"
    ],
    "scopes": [],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vtreport@malbeacon.com",
        "label": "vtreport@malbeacon.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed only in the VirusTotal false-positive contacts table in this inventory. Current engine participation and indicator scope have not been established; the contact may be historical.",
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "False positive contacts"
    ],
    "status": "contact-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Malbeacon false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "malpedia",
    "name": "Malpedia",
    "aliases": [
      "Malpedia"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/malpedia/signator-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/malpedia/signator-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Malpedia false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "malsilo",
    "name": "Malsilo",
    "aliases": [
      "Malsilo"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://raw-data.gitlab.io/post/feeds/",
    "contacts": [
      {
        "type": "social",
        "url": "https://x.com/_raw_data_",
        "label": "Maintainer profile (appeal acceptance unconfirmed)",
        "scope": "url",
        "source": "https://raw-data.gitlab.io/",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://raw-data.gitlab.io/",
        "title": "raw-data memdumps: Official maintainer links"
      },
      {
        "url": "https://raw-data.gitlab.io/post/feeds/",
        "title": "MalSilo: Intel feeds on the cheap"
      },
      {
        "url": "https://github.com/raw-data",
        "title": "Maintainer GitHub profile"
      },
      {
        "url": "https://raw-data.gitlab.io/post/malsilo_2.0/",
        "title": "Official MalSilo 2.0 project documentation"
      },
      {
        "url": "https://x.com/_raw_data_",
        "title": "Officially linked maintainer X profile"
      },
      {
        "url": "https://api.github.com/users/raw-data",
        "title": "Research evidence: api.github.com"
      },
      {
        "url": "https://gitlab.com/api/v4/users?username=raw-data",
        "title": "Research evidence: gitlab.com"
      },
      {
        "url": "https://github.com/raw-data/malarchive/issues/1",
        "title": "Research evidence: github.com"
      }
    ],
    "notes": [
      "The second review confirmed a traceable maintainer profile but found no dedicated form, public email or documented false-positive workflow. Public profiles are excluded from current contact totals."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "public-profile-only",
    "steps": [
      "Check the public maintainer profile linked from the project website for an available contact option.",
      "Ask which channel accepts MalSilo correction requests before sending sensitive information. Suggested context: the exact indicator, the VirusTotal report link, and the reason you believe the listing is mistaken.",
      "If the account offers no usable contact option, there is no verified appeal route in this directory."
    ],
    "description": "MalSilo's official project website links the maintainer's public X profile. A dedicated appeal form or email was not found, and acceptance of false-positive requests through the profile is unconfirmed.",
    "cautions": [
      "Only a maintainer profile was verified. No public email, dedicated form or documented false-positive workflow was found in the reviewed official sources.",
      "A GitHub issue tracker for the maintainer's separate malware-sample repository is not established as a MalSilo appeal channel."
    ],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Check the public maintainer profile linked from the project website for an available contact option.",
          "Ask which channel accepts MalSilo correction requests before sending sensitive information. Suggested context: the exact indicator, the VirusTotal report link, and the reason you believe the listing is mistaken.",
          "If the account offers no usable contact option, there is no verified appeal route in this directory."
        ],
        "cautions": [
          "Only a maintainer profile was verified. No public email, dedicated form or documented false-positive workflow was found in the reviewed official sources.",
          "A GitHub issue tracker for the maintainer's separate malware-sample repository is not established as a MalSilo appeal channel."
        ],
        "description": "MalSilo's official project website links the maintainer's public X profile. A dedicated appeal form or email was not found, and acceptance of false-positive requests through the profile is unconfirmed."
      }
    ],
    "indexable": false,
    "historicalContacts": [],
    "evidenceNotes": [
      {
        "level": "current-primary-source",
        "source": "https://api.github.com/users/raw-data",
        "observation": "The official-site-linked GitHub profile publishes no email or company; the public GPG keys endpoint is empty."
      },
      {
        "level": "current-primary-source",
        "source": "https://gitlab.com/api/v4/users?username=raw-data",
        "observation": "The raw-data and malsilo public GitLab profiles have empty public_email fields and returned no public projects in their user project listings."
      },
      {
        "level": "current-primary-source",
        "source": "https://github.com/raw-data/malarchive/issues/1",
        "observation": "The only repository issue concerns a sample password, with no comments. The separate repository was not promoted into a MalSilo support route."
      },
      {
        "level": "current-primary-source",
        "source": "https://x.com/_raw_data_",
        "observation": "The public profile metadata identifies raw-data, with no contact email or appeal instructions in the bio."
      }
    ]
  },
  {
    "slug": "malware-domain-blocklist",
    "name": "Malware Domain Blocklist",
    "aliases": [
      "DNS-BH - Malware Domain Blocklist",
      "Malware Domain Blocklist"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.malwaredomains.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@riskanalytics.com",
        "label": "RiskAnalytics support for legacy feed questions",
        "scope": "url",
        "source": "https://riskanalytics.com/community/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://riskanalytics.com/community/",
        "label": "Read the feed retirement notice",
        "scope": "url",
        "source": "https://riskanalytics.com/community/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://riskanalytics.com/community/",
        "title": "Official source: riskanalytics.com"
      }
    ],
    "notes": [
      "RiskAnalytics states that AutoShun and Malware Domains have been shut off and incorporated into ShadowNet. The legacy name can still appear in VirusTotal documentation.",
      "The published support mailbox is a fallback for questions about a legacy verdict, not a confirmed active delisting form."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets"
    ],
    "status": "retired",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find Malware Domain Blocklist false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "activity": "retired-source",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "malwarebytes",
    "name": "Malwarebytes",
    "aliases": [
      "Malwarebytes Corporation",
      "malwarebytes",
      "Malwarebytes"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.malwarebytes.org/",
    "contacts": [
      {
        "type": "support",
        "url": "https://forums.malwarebytes.com/forum/122-false-positives/",
        "label": "Malwarebytes false-positive forum",
        "source": "https://help.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://help.malwarebytes.com/hc/en-us/articles/360038524154-Report-a-false-positive-to-Malwarebytes-Support",
        "title": "Report a false positive to Malwarebytes Support"
      },
      {
        "url": "https://forums.malwarebytes.com/forum/122-false-positives/",
        "title": "False Positives forum"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Paid Malwarebytes subscribers can report false positives through support; other users can post in the official research forum.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "If you have a paid subscription, contact Malwarebytes Support about the false positive.",
          "Otherwise, register on the official forum and open a topic under False Positives > File Detections.",
          "Describe the detected file and include the detection evidence. Follow any request from the responding staff member for additional information."
        ],
        "cautions": [
          "Forum topics are public. Avoid putting confidential information in a post.",
          "Website Blocking and File Detections are separate forum categories."
        ],
        "description": "Paid Malwarebytes subscribers can report false positives through support; other users can post in the official research forum."
      }
    ],
    "indexable": true
  },
  {
    "slug": "malwared",
    "name": "Malwared",
    "aliases": [
      "Malware Must Die",
      "malwared",
      "Malwared"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://malwared.malwaremustdie.org/",
    "contacts": [
      {
        "type": "support",
        "url": "https://www.malwaremustdie.org/",
        "label": "MalwareMustDie published contact instructions",
        "scope": "url",
        "source": "https://www.malwaremustdie.org/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://www.malwaremustdie.org/",
        "title": "Official source: www.malwaremustdie.org"
      }
    ],
    "notes": [
      "The group asks for a direct message to its @malwaremustdie account or a comment on the relevant research blog post. No dedicated delisting process was found."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Open the official contact instructions and identify the research or indicator at issue.",
      "Use the published direct-message route, or comment on the relevant research post if the information can be shared publicly.",
      "Provide the VirusTotal report and request review of the exact URL or domain; avoid posting confidential evidence publicly."
    ],
    "description": "Find Malwared false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "malwarepatrol",
    "name": "MalwarePatrol",
    "aliases": [
      "MalwarePatrol",
      "malwarepatrol"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.malware.com.br/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:fp@malwarepatrol.net",
        "label": "fp@malwarepatrol.net",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find MalwarePatrol false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "malwareurl",
    "name": "MalwareURL",
    "aliases": [
      "MalwareURL"
    ],
    "scopes": [],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:team@malwareurl.com",
        "label": "team@malwareurl.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed only in the VirusTotal false-positive contacts table in this inventory. Current engine participation and indicator scope have not been established; the contact may be historical.",
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "False positive contacts"
    ],
    "status": "contact-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find MalwareURL false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "max",
    "name": "MAX",
    "aliases": [
      "max"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:root@malwares.com",
        "label": "Malwares.com file contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://blog.virustotal.com/2017/07/virustotal-max.html",
        "title": "VirusTotal welcomes MAX by Saint Security"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "VirusTotal described MAX as a Saint Security engine and part of malwares.com. The current VirusTotal directory provides a malwares.com file contact.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email root@malwares.com and identify MAX as the historical engine name.",
          "Provide the file SHA-256, VirusTotal report link, detection label and evidence supporting a false-positive review.",
          "Ask the current team whether it can review this legacy MAX result."
        ],
        "cautions": [
          "MAX and MaxSecure are different names; do not send MAX reports to MaxSecure solely because the names resemble each other.",
          "This legacy route is based on the documented engine origin and the current malwares.com contact; mailbox delivery and legacy-review capability have not been tested."
        ],
        "description": "VirusTotal described MAX as a Saint Security engine and part of malwares.com. The current VirusTotal directory provides a malwares.com file contact."
      }
    ],
    "indexable": false
  },
  {
    "slug": "maxsecure",
    "name": "MaxSecure",
    "aliases": [
      "MaxSecure",
      "maxsecure"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.maxpcsecure.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:tech@maxpcsecure.com",
        "label": "MaxSecure contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "VirusTotal lists MaxSecure's technical contact for suspected false-positive detections.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email tech@maxpcsecure.com with the VirusTotal report URL, exact MaxSecure detection label and SHA-256 of the affected file.",
          "Explain what the file does and why the detection appears incorrect; identify the software publisher and official download location if applicable.",
          "Ask for a false-positive review and follow any instructions returned by the vendor."
        ],
        "cautions": [
          "This contact is listed by VirusTotal. Its current delivery and response behavior have not been independently tested."
        ],
        "description": "VirusTotal lists MaxSecure's technical contact for suspected false-positive detections."
      }
    ],
    "indexable": true
  },
  {
    "slug": "mcafee",
    "name": "McAfee",
    "aliases": [
      "McAfee",
      "mcafee"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.mcafee.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.mcafee.com/en-us/consumer-support/dispute-detection-allowlisting.html",
        "label": "Dispute a Detection & Allowlisting",
        "source": "https://www.mcafee.com/en-us/consumer-support/dispute-detection-allowlisting.html",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.mcafee.com/en-us/consumer-support/dispute-detection-allowlisting.html",
        "title": "Dispute a Detection & Allowlisting Data"
      },
      {
        "url": "https://www.mcafee.com/support/s/article/000001921?id=35533&language=en_US",
        "title": "Submit a safe file incorrectly detected by McAfee"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "McAfee's Dispute a Detection form accepts clean-file review requests from users and software publishers.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open Dispute a Detection & Allowlisting Data.",
          "Enter your name, email, company if relevant, and details explaining why the detection is incorrect.",
          "Attach the file. For an application, include the installer and its extracted contents, then submit."
        ],
        "cautions": [
          "Use ZIP, RAR or extracted files; proprietary disk-image formats such as ISO, VMware and Norton Ghost are not supported.",
          "McAfee specifies a file size below 500 MB. WebAdvisor website-rating disputes use a different process."
        ],
        "description": "McAfee's Dispute a Detection form accepts clean-file review requests from users and software publishers."
      }
    ],
    "indexable": true
  },
  {
    "slug": "mcafee-gateway-edition",
    "name": "McAfee Gateway Edition",
    "aliases": [
      "mcafee_gw_edition"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:GatewayAnti-Malware-SupportEscalations@SkyhighSecurity.com",
        "label": "Skyhigh gateway anti-malware contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://success.skyhighsecurity.com/Skyhigh_Secure_Web_Gateway_%28On-Prem%29/Secure_Web_Gateway_Product_Guide/Secure_Web_Gateway_Reference/Web_Policy_Configuration/Module_Settings",
        "title": "Skyhigh Secure Web Gateway anti-malware module settings"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Skyhigh's Secure Web Gateway documentation retains the McAfee Gateway Anti-Malware terminology while documenting the current Skyhigh engine. The gateway team is a documented related route for a legacy gateway detection.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email the Skyhigh gateway anti-malware contact listed by VirusTotal and quote the exact historical McAfee Gateway Edition engine name.",
          "Provide the VirusTotal report URL, file SHA-256, detection label and reason for requesting a review.",
          "Ask the team to confirm ownership of the legacy result before supplying additional samples."
        ],
        "cautions": [
          "This is a successor-routing suggestion based on product documentation; a direct VirusTotal alias migration from mcafee_gw_edition to Skyhigh was not independently confirmed.",
          "Keep this historical entry distinct from consumer McAfee and Trellix endpoint detections."
        ],
        "description": "Skyhigh's Secure Web Gateway documentation retains the McAfee Gateway Anti-Malware terminology while documenting the current Skyhigh engine. The gateway team is a documented related route for a legacy gateway detection."
      }
    ],
    "indexable": false
  },
  {
    "slug": "microsoft",
    "name": "Microsoft",
    "aliases": [
      "Microsoft",
      "microsoft"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.microsoft.com/security/portal/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.microsoft.com/en-us/wdsi/filesubmission",
        "label": "Microsoft file submission",
        "source": "https://learn.microsoft.com/en-us/unified-secops/submission-guide",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://learn.microsoft.com/en-us/unified-secops/submission-guide",
        "title": "Submit files for analysis"
      },
      {
        "url": "https://www.microsoft.com/en-us/wdsi/filesubmission",
        "title": "Submit a file for malware analysis"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Microsoft Security Intelligence accepts files that were incorrectly classified as malware or potentially unwanted applications.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open the submission portal, sign in and choose the appropriate submitter role; software publishers should choose Software developer.",
          "Select the affected product and the appropriate Incorrectly detected option. Attach the exact detected file and give its detection name, source and relevant context.",
          "Track the final determination in submission history. Developers disputing that result can use the contact form supplied with the results."
        ],
        "cautions": [
          "Microsoft does not accept file samples by email.",
          "This route concerns file detections. Select the product actually responsible for the detection."
        ],
        "description": "Microsoft Security Intelligence accepts files that were incorrectly classified as malware or potentially unwanted applications."
      }
    ],
    "indexable": true
  },
  {
    "slug": "mimecast",
    "name": "Mimecast",
    "aliases": [
      "Mimecast"
    ],
    "scopes": [],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:bep-soc@mimecast.com",
        "label": "bep-soc@mimecast.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed only in the VirusTotal false-positive contacts table in this inventory. Current engine participation and indicator scope have not been established; the contact may be historical.",
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "False positive contacts"
    ],
    "status": "contact-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Mimecast false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "monitorapp",
    "name": "MONITORAPP",
    "aliases": [
      "AICC",
      "ailabs_monitorapp",
      "AILabs (Monitorapp)"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://aicc.monitorapp.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:aicc@monitorapp.com",
        "label": "aicc@monitorapp.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find MONITORAPP false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "nano-antivirus",
    "name": "NANO Antivirus",
    "aliases": [
      "Nano Security",
      "NANO-Antivirus",
      "nano_antivirus",
      "NANO"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.nanoav.ru/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:false@nanoav.ru",
        "label": "false@nanoav.ru",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      },
      {
        "type": "support",
        "url": "http://www.nanoav.ru/index.php?option=com_content&view=article&id=15&Itemid=83&lang=en",
        "label": "VirusTotal-listed contact",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find NANO Antivirus false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "netcraft",
    "name": "Netcraft",
    "aliases": [
      "Netcraft",
      "netcraft"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://news.netcraft.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://report.netcraft.com/report/mistake",
        "label": "Report a classification mistake",
        "scope": "url",
        "source": "https://virustotal.readme.io/docs/false-positive-contacts",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://report.netcraft.com/faqs",
        "label": "Submission issue instructions",
        "scope": "url",
        "source": "https://report.netcraft.com/faqs",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://report.netcraft.com/faqs",
        "title": "Netcraft Report FAQ"
      },
      {
        "url": "https://virustotal.readme.io/docs/false-positive-contacts",
        "title": "VirusTotal false-positive contacts"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Netcraft offers an incorrect-classification report and an issue workflow on existing submission pages.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open Netcraft's report-a-mistake page for an incorrectly flagged URL.",
          "If you have the original submission page, select the affected URL or file and choose Submit Issue.",
          "Explain the classification error and provide the relevant context in the available reason field."
        ],
        "cautions": [
          "The report website requires JavaScript.",
          "Use the current report.netcraft.com service; Netcraft identifies the old toolbar.netcraft.com reporting service as deprecated."
        ],
        "description": "Netcraft offers an incorrect-classification report and an issue workflow on existing submission pages."
      }
    ],
    "indexable": true
  },
  {
    "slug": "nmap",
    "name": "NMAP",
    "aliases": [
      "NMAP"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/aleksibovellan/opnsense-suricata-nmaps",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/aleksibovellan/opnsense-suricata-nmaps",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find NMAP false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "notmining",
    "name": "NotMining",
    "aliases": [
      "NotMining"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.notmining.es",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@notmining.com",
        "label": "Notmining support email",
        "scope": "url",
        "source": "https://www.notmining.es/resources/support",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://support.notmining.eu/",
        "label": "Notmining support ticket portal",
        "scope": "url",
        "source": "https://www.notmining.es/resources/support",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.notmining.es/resources/support",
        "title": "Official source: www.notmining.es"
      }
    ],
    "notes": [
      "The official support page publishes both routes. It does not document a separate VirusTotal appeal workflow."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find NotMining false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "nsfocus",
    "name": "NSFOCUS",
    "aliases": [
      "NSFOCUS POMA"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://poma.nsfocus.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@nsfocusglobal.com",
        "label": "NSFOCUS hardware and software support",
        "scope": "sandbox",
        "source": "https://nsfocusglobal.com/customer-portal/las-cp/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://nsfocusglobal.com/customer-portal/las-cp/",
        "title": "NSFOCUS hardware and software support"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "NSFOCUS publishes a hardware and software support address. Ask it to route a disputed POMA sandbox analysis to the appropriate team.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for NSFOCUS's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "This is global product support; support for the public POMA service and noncustomers must be confirmed."
        ],
        "description": "NSFOCUS publishes a hardware and software support address. Ask it to route a disputed POMA sandbox analysis to the appropriate team."
      }
    ],
    "indexable": true
  },
  {
    "slug": "openphish",
    "name": "OpenPhish",
    "aliases": [
      "FraudSense",
      "openphish",
      "OpenPhish"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.openphish.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@openphish.com",
        "label": "Email a false-positive report",
        "scope": "url",
        "source": "https://www.openphish.com/kb.html",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.openphish.com/kb.html",
        "title": "OpenPhish knowledge base"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "OpenPhish accepts false-positive reports by email and publishes corrections for confirmed errors.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Email support@openphish.com with the affected URL.",
          "Escape or defang the URL so that mail protection is less likely to block the message.",
          "Explain the context and why the classification is incorrect."
        ],
        "cautions": [
          "OpenPhish states that URLs confirmed as phishing when first discovered are not removed merely because they later change.",
          "For a confirmed false positive, OpenPhish says it updates its products and submits a verdict correction to VirusTotal."
        ],
        "description": "OpenPhish accepts false-positive reports by email and publishes corrections for confirmed errors."
      }
    ],
    "indexable": true
  },
  {
    "slug": "opera",
    "name": "Opera",
    "aliases": [
      "Opera"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.opera.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://opera.atlassian.net/servicedesk/customer/portal/7/group/9/create/10096",
        "label": "General Security Inquiry",
        "scope": "url",
        "source": "https://security.opera.com/en/report-security-issue/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://security.opera.com/en/report-security-issue/",
        "title": "Opera Security Team: Report an Issue"
      },
      {
        "url": "https://security.opera.com/en/malware-is-found-only-by-the-opera-browser-there-are-no-such-warnings-in-chrome-safari-or-firefox/",
        "title": "Opera: Identify the provider behind a browser warning"
      },
      {
        "url": "https://opera.atlassian.net/servicedesk/customer/portal/7/group/9/create/10096",
        "title": "Opera General Security Inquiry form"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Opera publishes a General Security Inquiry form. This is a general security contact, not a dedicated VirusTotal appeal queue. For an Opera browser warning, its published guidance is to identify the underlying blocklist provider and report a mistake to that provider.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "If Opera displays a warning, select ‘Why was this page blocked?’ to identify the provider behind it. Request a review from that provider.",
          "For an unexplained Opera verdict in VirusTotal, open General Security Inquiry. Enter your email and a concise summary; select the relevant Opera product or Other.",
          "Suggested details: the exact URL or domain, the VirusTotal report link, the Opera detection label, and evidence explaining why the classification is incorrect. Ask which team or upstream provider can review it."
        ],
        "cautions": [
          "The form does not promise to change VirusTotal verdicts. Opera's browser can use external blocklist providers."
        ],
        "description": "Opera publishes a General Security Inquiry form. This is a general security contact, not a dedicated VirusTotal appeal queue. For an Opera browser warning, its published guidance is to identify the underlying blocklist provider and report a mistake to that provider."
      }
    ],
    "indexable": true
  },
  {
    "slug": "orcapot",
    "name": "ORCAPOT",
    "aliases": [
      "ORCAPOT"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://orcapot.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:abuse@orcapot.com",
        "label": "abuse@orcapot.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find ORCAPOT false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "palo-alto-networks",
    "name": "Palo Alto Networks",
    "aliases": [
      "Palo Alto Networks (Known Signatures)",
      "paloalto",
      "Palo Alto"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.paloaltonetworks.com/",
    "contacts": [
      {
        "type": "support",
        "url": "https://live.paloaltonetworks.com/t5/virustotal/bd-p/VirusTotal_Discussions",
        "label": "VirusTotal verdict-change forum",
        "source": "https://live.paloaltonetworks.com/t5/virustotal/bd-p/VirusTotal_Discussions",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://live.paloaltonetworks.com/t5/virustotal/bd-p/VirusTotal_Discussions",
        "title": "Palo Alto Networks VirusTotal forum"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Palo Alto Networks maintains a VirusTotal forum for requests to change its file verdicts, including requests from non-customers.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Register or sign in to LIVEcommunity and open the VirusTotal forum.",
          "Create a verdict-change request containing the file hash, VirusTotal report link, current Palo Alto verdict and a description of the file.",
          "Explain what the program does and why the specific detection is incorrect."
        ],
        "cautions": [
          "The forum is public and is not a general customer-support channel.",
          "The forum describes its scope as Palo Alto Networks (Known Signatures) verdicts on VirusTotal."
        ],
        "description": "Palo Alto Networks maintains a VirusTotal forum for requests to change its file verdicts, including requests from non-customers."
      }
    ],
    "indexable": true
  },
  {
    "slug": "panda-security",
    "name": "Panda Security",
    "aliases": [
      "Panda",
      "panda",
      "Panda Security"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.pandasecurity.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:falsepositives@pandasecurity.com",
        "label": "falsepositives@pandasecurity.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      },
      {
        "type": "email",
        "url": "mailto:virussamples@pandasecurity.com",
        "label": "virussamples@pandasecurity.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Panda Security false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "phishfort",
    "name": "Phishfort",
    "aliases": [
      "Phishfort",
      "phishfort"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.phishfort.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://phishfort.com/contact-us/",
        "label": "PhishFort contact form",
        "scope": "url",
        "source": "https://phishfort.com/contact-us/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:hello@phishfort.com",
        "label": "PhishFort general support",
        "scope": "url",
        "source": "https://phishfort.com/contact-us/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://github.com/phishfort/phishfort-lists",
        "title": "Official source: github.com"
      },
      {
        "url": "https://lookup.phishfort.com/",
        "title": "Official source: lookup.phishfort.com"
      },
      {
        "url": "https://phishfort.com/contact-us/",
        "title": "Official source: phishfort.com"
      }
    ],
    "notes": [
      "The old public GitHub list was deprecated beginning May 1, 2025. The lookup site also now reports that its public blocklist API is deprecated.",
      "Use current general support to request review; do not assume a pull request to the retired public list will update current verdicts."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Use the vendor-published contact below to ask for a review of the exact VirusTotal detection.",
      "Include the affected URL or indicator, the VirusTotal report link, the engine label and a concise explanation with ownership or cleanup evidence.",
      "This is a general contact route; ask the recipient to direct your case to the team responsible for this verdict."
    ],
    "description": "Find Phishfort false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "phishing-database",
    "name": "Phishing.Database",
    "aliases": [
      "phishing_database",
      "Phishing Database",
      "Phishing.Database"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://github.com/mitchellkrogza/Phishing.Database",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/phishing-Database/Phishing.Database/?tab=readme-ov-file#requests--support",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Phishing.Database false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "phishlabs",
    "name": "Phishlabs",
    "aliases": [
      "PhishLabs",
      "Phishlabs",
      "phishlabs"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.phishlabs.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:info@phishlabs.com",
        "label": "info@phishlabs.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Phishlabs false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "phishtank",
    "name": "PhishTank",
    "aliases": [
      "Phishtank",
      "OpenDNS",
      "phishtank",
      "PhishTank / Snort IP"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.phishtank.com/",
    "contacts": [
      {
        "type": "support",
        "url": "https://phishtank.org/",
        "label": "Find the disputed submission",
        "scope": "url",
        "source": "https://phishtank.org/faq.php",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://phishtank.org/faq.php",
        "label": "False-positive reporting instructions",
        "scope": "url",
        "source": "https://phishtank.org/faq.php",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://phishtank.org/faq.php",
        "title": "PhishTank frequently asked questions"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "PhishTank handles incorrect phishing labels through the detail page of the disputed submission.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Find the affected URL using PhishTank's search or URL lookup.",
          "Open its Phish detail page.",
          "Choose Something wrong with this submission? and follow the reporting instructions."
        ],
        "cautions": [
          "Use the existing submission's correction link. Add A Phish is intended to report suspected phishing, not to appeal a false positive."
        ],
        "description": "PhishTank handles incorrect phishing labels through the detail page of the disputed submission."
      }
    ],
    "indexable": true
  },
  {
    "slug": "prebytes",
    "name": "Prebytes",
    "aliases": [
      "Prebytes",
      "prebytes"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://prebytes.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.support.prebytes.com/helpcenter/removals/",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Prebytes false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "precisionsec",
    "name": "PrecisionSec",
    "aliases": [
      "PrecisionSec",
      "precisionsec"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://precisionsec.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://precisionsec.com/contact/",
        "label": "PrecisionSec general inquiries (read restrictions)",
        "scope": "url",
        "source": "https://precisionsec.com/contact/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:info@precisionsec.com",
        "label": "PrecisionSec public inquiries mailbox",
        "scope": "url",
        "source": "https://precisionsec.com/contact/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://precisionsec.com/contact/",
        "title": "Official source: precisionsec.com"
      }
    ],
    "notes": [
      "The contact page states that third-party abuse reports sent by form or email are ignored. A dedicated false-positive appeal path is not confirmed."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Read the contact-page restrictions before sending information.",
      "For a verdict affecting your own property, ask whether PrecisionSec offers an owner false-positive review channel. Include the indicator and VirusTotal report link.",
      "This directory cannot confirm that the general contact form accepts delisting requests. Do not submit third-party abuse reports through it."
    ],
    "description": "Find PrecisionSec false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "prevx",
    "name": "Prevx",
    "aliases": [
      "prevx1"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "form",
        "url": "https://snup.webrootcloudav.com/SkyStoreFileUploader/upload.aspx",
        "label": "Webroot file false-positive submission",
        "scope": "file",
        "source": "https://answers.webroot.com/Webroot/ukp.aspx?app=vw&pid=17&solutionid=1839&t=False-positive-vendor&vw=1",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://mysupport.webrootanywhere.com/supportwelcome.aspx",
        "label": "Webroot support ticket",
        "scope": "file",
        "source": "https://answers.webroot.com/Webroot/ukp.aspx?app=vw&pid=17&solutionid=1839&t=False-positive-vendor&vw=1",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://www.webroot.com/in/en/business/webroot-history/",
        "title": "Webroot history: acquisition of Prevx"
      },
      {
        "url": "https://answers.webroot.com/Webroot/ukp.aspx?app=vw&pid=17&solutionid=1839&t=False-positive-vendor&vw=1",
        "title": "Webroot file false-positive guidance"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Webroot's official history records its acquisition of Prevx. The current Webroot file-review process is a route for asking about a legacy Prevx result.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Identify the old Prevx or prevx1 result in the request.",
          "Open the Webroot file-submission page and select False Positive detection as the reason.",
          "Provide the affected file or its hash and the requested context, then complete the CAPTCHA and submission terms.",
          "For a ticket with a contact email, use Webroot support and include the VirusTotal report URL, exact detection and software details."
        ],
        "cautions": [
          "This is a historical engine name; Webroot must confirm whether it can change a legacy VirusTotal result."
        ],
        "description": "Webroot's official history records its acquisition of Prevx. The current Webroot file-review process is a route for asking about a legacy Prevx result."
      }
    ],
    "indexable": false
  },
  {
    "slug": "pt-open-ruleset",
    "name": "PT Open Ruleset",
    "aliases": [
      "Positive Technologies",
      "PT Open Ruleset"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/ptresearch/AttackDetection/",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/ptresearch/AttackDetection/",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find PT Open Ruleset false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "qianxin",
    "name": "QiAnXin",
    "aliases": [
      "QiAnXin RedDrip"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://sandbox.ti.qianxin.com/sandbox/page",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:ti_support@qianxin.com",
        "label": "QiAnXin Threat Intelligence support contact",
        "scope": "sandbox",
        "source": "https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://ti.qianxin.com/uploads/2025/02/21/5c66fbda0feb2714c53f54dcedcd2e43.pdf",
        "title": "QiAnXin Threat Intelligence support contact"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "QiAnXin Threat Intelligence publishes ti_support@qianxin.com in its official threat reports. Use it to ask for routing of a sandbox analysis dispute.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for QiAnXin's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "This is a published threat-intelligence contact, not a verified dedicated false-positive mailbox.",
          "Include the sandbox report or task ID as well as the VirusTotal report; official source material is in Chinese."
        ],
        "description": "QiAnXin Threat Intelligence publishes ti_support@qianxin.com in its official threat reports. Use it to ask for routing of a sandbox analysis dispute."
      }
    ],
    "indexable": true
  },
  {
    "slug": "qihoo-360",
    "name": "Qihoo 360",
    "aliases": [
      "qihoo_360",
      "360",
      "Qihoo360"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:kefu@360.cn",
        "label": "kefu@360.cn",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Qihoo 360 false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "quick-heal",
    "name": "Quick Heal",
    "aliases": [
      "Cat Computer Services",
      "QuickHeal",
      "Quickheal",
      "quick_heal",
      "cat_quickheal"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.quickheal.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:viruslab@quickheal.com",
        "label": "viruslab@quickheal.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Quick Heal false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "quttera",
    "name": "Quttera",
    "aliases": [
      "Quttera",
      "quttera"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.quttera.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@quttera.com",
        "label": "Email Quttera support",
        "scope": "url",
        "source": "https://quttera.com/quttera-labs",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://helpdesk.quttera.com/",
        "label": "Quttera helpdesk",
        "scope": "url",
        "source": "https://quttera.com/quttera-labs",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://quttera.com/quttera-labs",
        "title": "Quttera Labs: incorrect detections and false positives"
      },
      {
        "url": "https://virustotal.readme.io/docs/false-positive-contacts",
        "title": "VirusTotal false-positive reporting guidance"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Quttera Labs publishes both a helpdesk and an email channel for incorrect detections and false positives.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open a helpdesk request or email support@quttera.com to report the incorrect detection.",
          "Identify the affected domain or URL and describe the result you dispute.",
          "For a VirusTotal detection, include its report link so the vendor can identify the relevant result."
        ],
        "cautions": [
          "Quttera's Report Phishing page is a route for reporting malicious websites; use the false-positive support channel for a correction."
        ],
        "description": "Quttera Labs publishes both a helpdesk and an email channel for incorrect detections and false positives."
      }
    ],
    "indexable": true
  },
  {
    "slug": "reaqta",
    "name": "ReaQta",
    "aliases": [
      "ReaQta-Hive"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://reaqta.com/hive/",
    "contacts": [
      {
        "type": "support",
        "url": "https://www.ibm.com/support/pages/qradar-edr-formerly-reaqta-saas-support-frequently-asked-questions-faq",
        "label": "IBM ReaQta / QRadar EDR support instructions",
        "scope": "sandbox",
        "source": "https://www.ibm.com/support/pages/qradar-edr-formerly-reaqta-saas-support-frequently-asked-questions-faq",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.ibm.com/support/pages/qradar-edr-formerly-reaqta-saas-support-frequently-asked-questions-faq",
        "title": "QRadar EDR formerly ReaQta: support FAQ"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "IBM identifies ReaQta as the former name of QRadar EDR and publishes product-specific support instructions.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the IBM QRadar EDR / ReaQta support instructions to open a case with your IBMid.",
          "Identify the old ReaQta VirusTotal analysis, provide its report URL and file SHA-256, and describe the disputed finding.",
          "Ask IBM support to confirm the appropriate team for the affected deployment or legacy analysis."
        ],
        "cautions": [
          "IBM's instructions require an IBMid linked to the company customer account.",
          "This is a product-support route, not a confirmed public ReaQta false-positive form. Legacy-product and support entitlement restrictions may apply."
        ],
        "description": "IBM identifies ReaQta as the former name of QRadar EDR and publishes product-specific support instructions."
      }
    ],
    "indexable": true
  },
  {
    "slug": "reversing-labs",
    "name": "Reversing Labs",
    "aliases": [
      "Reversing Labs"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/reversinglabs/reversinglabs-yara-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/reversinglabs/reversinglabs-yara-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Reversing Labs false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "rising",
    "name": "Rising",
    "aliases": [
      "Rising Antivirus",
      "rising",
      "Rising"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.rising.com.cn/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:fp@rising.com.cn",
        "label": "fp@rising.com.cn",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Rising false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "russianpanda",
    "name": "RussianPanda",
    "aliases": [
      "RussianPanda"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/RussianPanda95/Sigma-Rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/RussianPanda95/Sigma-Rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      },
      {
        "type": "repository",
        "url": "https://github.com/RussianPanda95/Malware-Rules-IOCs",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced Sigma Rules",
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find RussianPanda false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "safetoopen",
    "name": "SafeToOpen",
    "aliases": [
      "SafeToOpen",
      "safetoopen"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://safetoopen.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@safetoopen.com",
        "label": "virustotal@safetoopen.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find SafeToOpen false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "sands-lab-malwares-com",
    "name": "SANDS Lab / Malwares.com",
    "aliases": [
      "SANDS Lab",
      "CTX",
      "Malwares.com",
      "Saint Security",
      "malwares_com_url_checker",
      "ctx",
      "CTX (SaintSecurity)",
      "Malwares.com (Saint Security)"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://malwares.com",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:root@malwares.com",
        "label": "root@malwares.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      },
      {
        "type": "email",
        "url": "mailto:kog@stsc.com",
        "label": "kog@stsc.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find SANDS Lab / Malwares.com false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "sangfor",
    "name": "Sangfor",
    "aliases": [
      "Sangfor Engine Zero",
      "Sangfor ZSand",
      "ZSand",
      "sangfor",
      "Sangfor"
    ],
    "scopes": [
      "file",
      "sandbox",
      "url"
    ],
    "website": "http://www.sangfor.com.cn/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@sangfor.com.cn",
        "label": "virustotal@sangfor.com.cn",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Behavioral analysis / sandbox products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Sangfor false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "sansec",
    "name": "Sansec",
    "aliases": [
      "Sansec eComscan"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://sansec.io/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@sansec.io",
        "label": "virustotal@sansec.io",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Sansec false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "scantitan",
    "name": "Scantitan",
    "aliases": [
      "Scantitan",
      "scantitan"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.scantitan.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:fp@scantitan.com",
        "label": "fp@scantitan.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Scantitan false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "scumware",
    "name": "Scumware",
    "aliases": [
      "SCUMWARE",
      "Scumware.org",
      "scumware_org"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.scumware.org/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.scumware.org/removals.php",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Scumware false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "seclookup",
    "name": "SecLookup",
    "aliases": [
      "seclookup",
      "Seclookup"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:info@seclookup.com",
        "label": "info@seclookup.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find SecLookup false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "secneurx",
    "name": "SecneurX",
    "aliases": [
      "SecneurX"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://www.secneurx.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:info@secneurx.com",
        "label": "SecneurX general contact",
        "scope": "sandbox",
        "source": "https://www.secneurx.com/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.secneurx.com/",
        "title": "SecneurX general contact"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "SecneurX publishes a general inquiry email on its official website for contacting the company about a disputed analysis.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for SecneurX's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed."
        ],
        "description": "SecneurX publishes a general inquiry email on its official website for contacting the company about a disputed analysis."
      }
    ],
    "indexable": true
  },
  {
    "slug": "secondwrite",
    "name": "SecondWrite",
    "aliases": [
      "SecondWrite Deep View"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://www.secondwrite.com/?utm_source=virus_total",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:info@secondwrite.com",
        "label": "SecondWrite general inquiry email",
        "scope": "sandbox",
        "source": "https://www.secondwrite.com/contact/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.secondwrite.com/contact/",
        "title": "SecondWrite general inquiry email"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "SecondWrite's indexed official contact page publishes a general inquiry email that can be used to request routing of an analysis dispute.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for SecondWrite's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "A direct website fetch encountered a TLS certificate mismatch during this audit. The email was found in the indexed official contact page; delivery has not been tested."
        ],
        "description": "SecondWrite's indexed official contact page publishes a general inquiry email that can be used to request routing of an analysis dispute."
      }
    ],
    "indexable": true
  },
  {
    "slug": "secureage",
    "name": "SecureAge",
    "aliases": [
      "SecureAge"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.secureage.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://uav.secureage.com/falsepositive/index.php",
        "label": "SecureAge file false-positive form",
        "source": "https://www.secureage.com/contact-us",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.secureage.com/contact-us",
        "title": "SecureAge Contact Us"
      },
      {
        "url": "https://uav.secureage.com/falsepositive/index.php",
        "title": "SecureAge false-positive file upload"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "SecureAge's contact page links to a dedicated file false-positive upload form.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open the SecureAge false-positive form.",
          "Enter your email and a description including the detection details and the file's legitimate purpose.",
          "Select or drag the affected file into the form, and choose whether to receive verification by email.",
          "Complete the upload and retain any confirmation."
        ],
        "cautions": [
          "The linked form accepts files up to 30 MB.",
          "SecureAge's contact page describes this workflow as supporting CatchPulse and its detecting engines."
        ],
        "description": "SecureAge's contact page links to a dedicated file false-positive upload form."
      }
    ],
    "indexable": true
  },
  {
    "slug": "securebrain",
    "name": "SecureBrain",
    "aliases": [
      "SecureBrain",
      "securebrain"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.securebrain.co.jp/eng/web/index.php",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.securebrain.co.jp/form/gredss/sbformmail.php",
        "label": "GRED website-check product support",
        "scope": "url",
        "source": "https://www.securebrain.co.jp/support/index.html",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:biz.support.cg@hitachi-systems.com",
        "label": "SecureBrain corporate product support",
        "scope": "url",
        "source": "https://www.securebrain.co.jp/support/index.html",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://www.securebrain.co.jp/support/index.html",
        "title": "Hitachi Systems / former SecureBrain: Corporate product support"
      },
      {
        "url": "https://www.securebrain.co.jp/form/gredss/sbformmail.php",
        "title": "GRED website-check inquiry form"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "The current SecureBrain website directs corporate product support to Hitachi Systems. It publishes a technical-support email and a GRED website-check support form. These are product-support channels; a dedicated public VirusTotal appeal procedure was not verified.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Use the corporate product-support email or the GRED website-check form to ask for the appropriate review team.",
          "Include the product name and operating system, as requested by the support page. Clearly identify the SecureBrain verdict in VirusTotal if that is the only product involved.",
          "Suggested details: the exact affected URL, VirusTotal report link, detection text, and a short explanation of the legitimate site or completed cleanup."
        ],
        "cautions": [
          "The support page describes assistance for purchased corporate products. Acceptance of requests from noncustomers about a VirusTotal result is not confirmed.",
          "The linked support pages and form are in Japanese."
        ],
        "description": "The current SecureBrain website directs corporate product support to Hitachi Systems. It publishes a technical-support email and a GRED website-check support form. These are product-support channels; a dedicated public VirusTotal appeal procedure was not verified."
      }
    ],
    "indexable": true
  },
  {
    "slug": "securolytics",
    "name": "Securolytics",
    "aliases": [
      "securolytics",
      "Securolytics"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "support",
        "url": "https://tickets.securolytics.io/portal/en/kb/securolytics-1",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Securolytics false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "segasec",
    "name": "Segasec",
    "aliases": [
      "segasec"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "support",
        "url": "https://mimecastsupport.zendesk.com/hc/en-us",
        "label": "Mimecast customer support (Segasec successor)",
        "scope": "url",
        "source": "https://www.mimecast.com/company/contact/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://www.mimecast.com/resources/press-releases/mimecast-acquires-segasec/",
        "title": "Mimecast acquires Segasec"
      },
      {
        "url": "https://www.mimecast.com/company/contact/",
        "title": "Mimecast contact and customer support"
      },
      {
        "url": "https://mimecastsupport.zendesk.com/hc/en-us",
        "title": "Mimecast Support Center"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Mimecast acquired Segasec in 2020. Mimecast now publishes a customer Support Center. This is a successor-company support route, not a verified dedicated appeal channel for the legacy Segasec label in VirusTotal.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open Mimecast's Support Center or the Customer support section of its contact page.",
          "If you have customer support access, raise a case identifying the Segasec label and ask whether the team can review or route the report.",
          "Suggested details: the exact domain or URL, the VirusTotal report link, the detection date, and evidence of legitimate ownership and content."
        ],
        "cautions": [
          "Customer access may be needed to raise a case. No public commitment to process noncustomer appeals for legacy Segasec verdicts was found.",
          "The acquisition does not by itself establish that the VirusTotal engine is retired."
        ],
        "description": "Mimecast acquired Segasec in 2020. Mimecast now publishes a customer Support Center. This is a successor-company support route, not a verified dedicated appeal channel for the legacy Segasec label in VirusTotal."
      }
    ],
    "indexable": false
  },
  {
    "slug": "sentinelone",
    "name": "SentinelOne",
    "aliases": [
      "SentinelOne (Static ML)",
      "sentinelone",
      "Sentinel One",
      "SentinelOne"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://sentinelone.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:report@sentinelone.com",
        "label": "SentinelOne contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "VirusTotal lists this report address for SentinelOne engine detections.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email report@sentinelone.com with the VirusTotal report URL, exact SentinelOne detection label and SHA-256 of the affected file.",
          "Explain what the file does and why the detection appears incorrect; identify the software publisher and official download location if applicable.",
          "Ask for a false-positive review and follow any instructions returned by the vendor."
        ],
        "cautions": [
          "This contact is listed by VirusTotal. Its current delivery and response behavior have not been independently tested."
        ],
        "description": "VirusTotal lists this report address for SentinelOne engine detections."
      }
    ],
    "indexable": true
  },
  {
    "slug": "sigmahq",
    "name": "SigmaHQ",
    "aliases": [
      "SigmaHQ"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/SigmaHQ/sigma",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/SigmaHQ/sigma",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced Sigma Rules"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find SigmaHQ false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "skyhigh-security",
    "name": "Skyhigh Security",
    "aliases": [
      "Skyhigh (SWG)",
      "Skyhigh",
      "Skyhigh Security"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.skyhighsecurity.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:GatewayAnti-Malware-SupportEscalations@SkyhighSecurity.com",
        "label": "GatewayAnti-Malware-SupportEscalations@SkyhighSecurity.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Skyhigh Security false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "snort",
    "name": "Snort",
    "aliases": [
      "CISCO",
      "Snort"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://www.snort.org/downloads/#rule-downloads",
    "contacts": [
      {
        "type": "support",
        "url": "https://talosintelligence.com/reputation_center/ips_ids",
        "label": "Talos Snort IPS/IDS false-positive ticket",
        "scope": "rules",
        "source": "https://www.snort.org/community",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.snort.org/community",
        "title": "Snort Community: report a false positive"
      },
      {
        "url": "https://talosintelligence.com/reputation_center/ips_ids",
        "title": "Talos IPS/IDS Support Ticket"
      },
      {
        "url": "https://www.snort.org/contact",
        "title": "Snort Contact"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Snort's official community page links to Talos IPS/IDS Support for reporting Snort rule false positives.",
    "cautions": [],
    "guides": [
      {
        "scope": "rules",
        "steps": [
          "Open the Talos IPS/IDS support page and sign in with a Cisco account.",
          "Submit a Snort rule false-positive ticket. Identify the SID, revision, exact alert, affected traffic and VirusTotal report URL.",
          "Explain why the traffic is legitimate and provide the evidence requested by the rule team."
        ],
        "cautions": [
          "A Cisco account is required. This is the Snort IPS/IDS route, distinct from Talos domain-reputation disputes."
        ],
        "description": "Snort's official community page links to Talos IPS/IDS Support for reporting Snort rule false positives."
      }
    ],
    "indexable": true
  },
  {
    "slug": "snort-ip-sample-list",
    "name": "Snort IP Sample List",
    "aliases": [
      "snort_ip_sample_list"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "support",
        "url": "https://www.phishtank.com/contact.php#:~:text=To%20report%20a%20%22false%20positive%22%20%28a%20site%20incorrectly%20flagged%20as%20phishing%29%2C%20please%20go%20to%20the%20Phish%20Detail%20page%20for%20the%20site%20in%20question%2C%20click%20the%20link%20labeled%20%22Site%20is%20not%20a%20phish%22%20and%20follow%20instructions.%20Start%20at%20the%20Phish%20Archive",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "VirusTotal labels this shared contact row “PhishTank / Snort IP”. The published link is a PhishTank contact page; confirm that it applies to your exact Snort IP result before submitting.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Confirm that the detection label is Snort IP sample list rather than a separate Snort rule match.",
      "Open the VirusTotal-listed PhishTank contact instructions and ask which route handles the exact indicator.",
      "Provide the VirusTotal report and avoid sending file-rule disputes to a phishing URL workflow."
    ],
    "description": "Find Snort IP Sample List false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "socradar",
    "name": "SOCRadar",
    "aliases": [
      "SOCRadar",
      "socradar"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://socradar.io/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:vt@socradar.io",
        "label": "vt@socradar.io",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find SOCRadar false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "sophos",
    "name": "Sophos",
    "aliases": [
      "Sophos",
      "sophos"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.sophos.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://support.sophos.com/support/s/filesubmission?language=en_US",
        "label": "Submit a URL for reassessment",
        "scope": "url",
        "source": "https://support.sophos.com/support/s/article/KBA-000002950?language=en_US",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:samples@sophos.com",
        "label": "samples@sophos.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "support",
        "url": "https://support.sophos.com/",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://support.sophos.com/support/s/article/KBA-000002950?language=en_US",
        "title": "Sophos Endpoint: website is blocked or has restricted access"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Sophos false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open the Submit a Sample page and select Web Address (URL).",
          "Enter the affected URL, your contact details, the Sophos product or service, and the reason for reassessment.",
          "Complete the required fields and select Submit URL."
        ],
        "cautions": [
          "For non-customers, Sophos asks which product caused the warning. If that cannot be established, its guidance allows the best available guess in the required Product/Services field.",
          "An organization's web-control policy may block a category even when the classification is accurate."
        ],
        "description": "Sophos accepts URL reassessment requests for malware detections and incorrect website classifications."
      },
      {
        "scope": "file",
        "steps": [
          "Record the file SHA-256, filename and exact detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "spam404",
    "name": "Spam404",
    "aliases": [
      "Spam404",
      "spam404"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.spam404.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.spam404.com/revision-request-domain.html",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Spam404 false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "spamhaus",
    "name": "Spamhaus",
    "aliases": [
      "The Spamhaus Project",
      "Spamhaus"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.spamhaus.org/",
    "contacts": [
      {
        "type": "form",
        "url": "https://check.spamhaus.org/",
        "label": "Check a domain and request removal",
        "scope": "url",
        "source": "https://www.spamhaus.org/faqs/domain-blocklist/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.spamhaus.org/faqs/domain-blocklist/",
        "title": "Spamhaus Domain Blocklist FAQ"
      },
      {
        "url": "https://www.spamhaus.org/faqs/general-questions/",
        "title": "General questions relating to Spamhaus datasets"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Spamhaus domain removals start with its IP and Domain Reputation Checker and the instructions for the specific listing.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Look up the exact domain or hostname in the Spamhaus checker.",
          "Read the listing and address the reported abuse or compromise.",
          "As the registered owner, follow the returned removal process and supply the requested remediation information."
        ],
        "cautions": [
          "Spamhaus does not process removal requests through arbitrary email channels. The lookup result determines the applicable procedure.",
          "Removal is free and is not guaranteed merely by submitting a request.",
          "This domain-blocklist route differs from the process for an ISP-managed SBL IP listing."
        ],
        "description": "Spamhaus domain removals start with its IP and Domain Reputation Checker and the instructions for the specific listing."
      }
    ],
    "indexable": true
  },
  {
    "slug": "stopforumspam",
    "name": "StopForumSpam",
    "aliases": [
      "stopforumspam",
      "Stopforumspam"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.stopforumspam.com/removal",
        "label": "VirusTotal-listed contact",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find StopForumSpam false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "stratosphere-ips",
    "name": "Stratosphere IPS",
    "aliases": [
      "Stratosphere IPS"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/stratosphereips/yara-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/stratosphereips/yara-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Stratosphere IPS false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "sucuri",
    "name": "Sucuri",
    "aliases": [
      "Sucuri SiteCheck",
      "sucuri_sitecheck",
      "Sucuri"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://sitecheck.sucuri.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:soc@sucuri.net",
        "label": "soc@sucuri.net",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Sucuri false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "sunbelt",
    "name": "Sunbelt",
    "aliases": [
      "sunbelt"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "support",
        "url": "https://helpdesk.vipre.com/hc/en-us/requests/new",
        "label": "VIPRE support listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VIPRE support listed by VirusTotal"
      },
      {
        "url": "https://www.prnewswire.com/news-releases/sunbelt-software-announces-major-upgrade-to-vipre-enterprise-expands-line-to-include-new-premium-edition-85952732.html",
        "title": "Sunbelt announcement of its VIPRE antivirus product"
      },
      {
        "url": "https://www.prnewswire.com/news-releases/gfi-software-establishes-independent-company-focused-on-developing-advanced-security-solutions-198768731.html",
        "title": "GFI announcement: VIPRE business becomes ThreatTrack Security"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Sunbelt developed the VIPRE antivirus product line. The current VIPRE support desk is a related route for questions about historical Sunbelt detections.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Use the official general contact below and ask for the team responsible for Sunbelt's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, exact detection label and software publisher. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "This preserves a legacy engine name. VIPRE support must confirm whether it can review the old Sunbelt result."
        ],
        "description": "Sunbelt developed the VIPRE antivirus product line. The current VIPRE support desk is a related route for questions about historical Sunbelt detections."
      }
    ],
    "indexable": false
  },
  {
    "slug": "superantispyware",
    "name": "SUPERAntiSpyware",
    "aliases": [
      "SUPERAntiSpyware",
      "superantispyware"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.superantispyware.com/",
    "contacts": [
      {
        "type": "support",
        "url": "https://www.superantispyware.com/technical-support",
        "label": "SUPERAntiSpyware technical support",
        "scope": "file",
        "source": "https://www.superantispyware.com/faq/i-think-superantispyware-detected-something-it-should-not-have-what-do-i-do",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://www.superantispyware.com/faq/i-think-superantispyware-detected-something-it-should-not-have-what-do-i-do",
        "title": "SUPERAntiSpyware false-positive FAQ"
      },
      {
        "url": "https://www.superantispyware.com/technical-support",
        "title": "SUPERAntiSpyware technical support"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "SUPERAntiSpyware's official false-positive FAQ directs users to include a VirusTotal report in a technical support ticket.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open the official technical-support page and choose the applicable product or issue category.",
          "Request a false-positive review and include the existing VirusTotal analysis URL, affected filename, hash and detection label.",
          "The vendor also documents submitting a file from the installed application through System Tools & Program Settings, then Submit Malware Samples."
        ],
        "cautions": [
          "Only submit a sample when you have permission to share it."
        ],
        "description": "SUPERAntiSpyware's official false-positive FAQ directs users to include a VirusTotal report in a technical support ticket."
      }
    ],
    "indexable": true
  },
  {
    "slug": "suricata",
    "name": "Suricata",
    "aliases": [
      "Open Information Security Foundation",
      "Suricata"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://suricata-ids.org/",
    "contacts": [
      {
        "type": "form",
        "url": "https://feedback.emergingthreats.net/",
        "label": "Emerging Threats rule feedback only",
        "scope": "rules",
        "source": "https://forum.suricata.io/t/rule-threshold-configuration/2461",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://forum.suricata.io/",
        "label": "Suricata community: rule-owner guidance",
        "scope": "rules",
        "source": "https://forum.suricata.io/t/rule-threshold-configuration/2461",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.suricata.io/en/suricata-8.0.0/make-sense-alerts.html",
        "title": "Suricata documentation: interpret alerts and rule owners"
      },
      {
        "url": "https://forum.suricata.io/t/rule-threshold-configuration/2461",
        "title": "Suricata forum: Emerging Threats staff guidance"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Suricata is a rules engine. False-positive corrections should be addressed to the author of the matching rule; the official forum can help identify that owner.",
    "cautions": [],
    "guides": [
      {
        "scope": "rules",
        "steps": [
          "Inspect the matching rule, including its SID, revision, message prefix and reference fields.",
          "For an Emerging Threats rule, use the Emerging Threats feedback portal; for another ruleset, contact that rule's maintainer.",
          "If ownership is unclear, ask in the Suricata forum and include the rule identifier, alert context and VirusTotal report link."
        ],
        "cautions": [
          "Suricata does not author every ruleset it runs. A forum response does not itself change a third-party signature.",
          "Avoid posting private packet captures or credentials in a public forum."
        ],
        "description": "Suricata is a rules engine. False-positive corrections should be addressed to the author of the matching rule; the official forum can help identify that owner."
      }
    ],
    "indexable": true
  },
  {
    "slug": "symantec",
    "name": "Symantec",
    "aliases": [
      "Symantec Corporation",
      "Symantec Mobile Insight",
      "symantec",
      "symantecmobileinsight",
      "Symantec"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.symantec.com/business/endpoint-protection",
    "contacts": [
      {
        "type": "form",
        "url": "https://symsubmit.symantec.com",
        "label": "SymSubmit",
        "source": "https://knowledge.broadcom.com/external/article?articleNumber=176256",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://knowledge.broadcom.com/external/article?articleNumber=176256",
        "title": "Using SymSubmit for Symantec and Carbon Black Products"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "SymSubmit is Broadcom's official submission portal for false positives affecting Symantec products.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Open SymSubmit and select Clean software incorrectly detected.",
          "Choose a file submission method: upload the file, provide a supported hash available on VirusTotal, or give a direct download URL.",
          "Complete the product, detection and contact details. If the relevant product is not listed, use the option indicating that none of the products apply.",
          "Submit and retain the case information."
        ],
        "cautions": [
          "Hash submissions accept MD5 or SHA-256 for a single publicly available file; container hashes are not supported.",
          "The portal's current upload, archive and URL size limits differ, so check the instructions for your chosen submission method."
        ],
        "description": "SymSubmit is Broadcom's official submission portal for false positives affecting Symantec products."
      }
    ],
    "indexable": true
  },
  {
    "slug": "tehtris",
    "name": "TEHTRIS",
    "aliases": [
      "TEHTRI-Security",
      "egambit",
      "eGambit (Tehtris)"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://tehtris.com/en/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virus@tehtris.com",
        "label": "virus@tehtris.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find TEHTRIS false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "tencent",
    "name": "Tencent",
    "aliases": [
      "HABO",
      "Tencent",
      "tencent"
    ],
    "scopes": [
      "file",
      "sandbox"
    ],
    "website": "http://www.tencent.com/en-us/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:TAVfp@tencent.com",
        "label": "TAVfp@tencent.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Behavioral analysis / sandbox products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Tencent false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "the-dfir-report",
    "name": "The DFIR Report",
    "aliases": [
      "DFIR"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/The-DFIR-Report/Yara-Rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/The-DFIR-Report/Yara-Rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find The DFIR Report false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "thehacker-hacksoft",
    "name": "TheHacker / Hacksoft",
    "aliases": [
      "thehacker",
      "Hacksoft",
      "TheHacker"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virus@hacksoft.com.pe",
        "label": "virus@hacksoft.com.pe",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      },
      {
        "type": "email",
        "url": "mailto:falsopositivo@hacksoft.com.pe",
        "label": "falsopositivo@hacksoft.com.pe",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find TheHacker / Hacksoft false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": false
  },
  {
    "slug": "thomas-tad-damonneville",
    "name": "Thomas 'tAd' Damonneville",
    "aliases": [
      "T4D",
      "Thomas 'tAd' Damonneville"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/t4d/PhishingKit-Yara-Rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/t4d/PhishingKit-Yara-Rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Thomas 'tAd' Damonneville false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "threat-hunting-rules",
    "name": "Threat hunting rules",
    "aliases": [
      "Travis Green",
      "Threat hunting rules"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/travisbgreen/hunting-rules",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/travisbgreen/hunting-rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Crowdsourced IDS (Intrusion Detection systems)"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Threat hunting rules false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "threathive",
    "name": "ThreatHive",
    "aliases": [
      "The Malwarelab",
      "threathive",
      "ThreatHive"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://twitter.com/ThreatHive",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:adam@threathive.com",
        "label": "adam@threathive.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find ThreatHive false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "total-defense",
    "name": "Total Defense",
    "aliases": [
      "totaldefense"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [
      {
        "type": "support",
        "url": "https://support.totaldefense.com/hc/en-us/articles/228497367-What-Is-A-False-Positive",
        "label": "Total Defense false-positive support instructions",
        "scope": "file",
        "source": "https://support.totaldefense.com/hc/en-us/articles/228497367-What-Is-A-False-Positive",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://support.totaldefense.com/hc/en-us/articles/228497367-What-Is-A-False-Positive",
        "title": "Total Defense: What Is A False Positive?"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Total Defense's official false-positive article instructs users to contact technical support and provide detected legitimate files through the representative.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Read the official false-positive article and call the listed technical-support number, 877-906-8816, to open the issue.",
          "Describe the detection and provide the VirusTotal report URL, file hash and evidence of legitimate use.",
          "Follow the representative's instructions for emailing a ZIP of the affected files; the article does not publish a direct sample mailbox."
        ],
        "cautions": [
          "This directory preserves the Total Defense vendor prefix; it does not assert current participation as a separate active engine.",
          "Confirm the number and current submission instructions on the official page before sending a sample."
        ],
        "description": "Total Defense's official false-positive article instructs users to contact technical support and provide detected legitimate files through the representative."
      }
    ],
    "indexable": false
  },
  {
    "slug": "trapmine",
    "name": "Trapmine",
    "aliases": [
      "Trapmine",
      "trapmine"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.trapmine.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:fp@trapmine.com",
        "label": "Trapmine false-positive reports",
        "source": "https://www.trapmine.com/",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://www.trapmine.com/",
        "title": "Trapmine maintenance and false-positive contact notice"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Trapmine's own website confirms that its VirusTotal ML scanner is maintained and accepts false-positive reports by email.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email the false-positive address with a clear subject identifying the suspected mistaken file detection.",
          "Include the VirusTotal report URL, the file hash, the Trapmine detection name and a short description of the software.",
          "Request a review and follow any sample-handling instructions returned by the team."
        ],
        "cautions": [
          "Trapmine's site says its intellectual-property assets were acquired, but specifically states that the VirusTotal ML scanner remains maintained.",
          "No delivery or response test was performed."
        ],
        "description": "Trapmine's own website confirms that its VirusTotal ML scanner is maintained and accepts false-positive reports by email."
      }
    ],
    "indexable": true
  },
  {
    "slug": "trellix",
    "name": "Trellix",
    "aliases": [
      "Trellix (FireEye)",
      "Trellix ENS",
      "Trellix Endpoint Security",
      "fireeye",
      "trellixens",
      "FireEye",
      "Trellix"
    ],
    "scopes": [
      "file",
      "rules"
    ],
    "website": "https://www.trellix.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:datasubmission@trellix.com",
        "label": "Trellix submission email (VT-listed)",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://supportm.trellix.com",
        "label": "Trellix support service request",
        "source": "https://docs.trellix.com/network-and-platform/docs/submit-false-positive-samples",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:datasubmission@trellix.com",
        "label": "datasubmission@trellix.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "repository",
        "url": "https://github.com/advanced-threat-research/Yara-Rules",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      },
      {
        "url": "https://docs.trellix.com/docs/submitting-threat-samples-for-analysis",
        "title": "Submitting threat samples for analysis"
      },
      {
        "url": "https://docs.trellix.com/network-and-platform/docs/submit-false-positive-samples",
        "title": "Submit false positive samples"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "YARA rule repositories",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Trellix false-positive review channels for files and rules. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "For the Trellix verdict shown in a VirusTotal report, use the VT-listed email and include the report URL, exact engine name, file hash and detection details.",
          "If you are a Trellix customer, open a service request in the Trellix support portal and provide the false-positive sample.",
          "Explain the file's legitimate purpose and follow the team's sample-submission instructions."
        ],
        "cautions": [
          "The email datasubmission@trellix.com is confirmed in VirusTotal's directory, not by an email delivery test.",
          "Trellix and McAfee have separate current submission routes. Use the brand and engine shown in the report."
        ],
        "description": "Trellix documents sample review through its Advanced Research Center and support service requests; VirusTotal lists a dedicated data-submission email."
      },
      {
        "scope": "rules",
        "steps": [
          "Record the rule identifier, matched indicator and the report URL.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "trend-micro",
    "name": "Trend Micro",
    "aliases": [
      "TrendMicro",
      "TrendMicro-HouseCall",
      "Trend Micro Site Safety Center",
      "trendmicro",
      "trendmicro_housecall",
      "Trend Micro"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.trendmicro.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://global.sitesafety.trendmicro.com/",
        "label": "Check and request reclassification",
        "scope": "url",
        "source": "https://success.trendmicro.com/en-US/solution/KA-0000017",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:virus_doctor@trendmicro.com",
        "label": "virus_doctor@trendmicro.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      },
      {
        "type": "support",
        "url": "https://www.trendmicro.com/en_us/about/legal/detection-reevaluation.html",
        "label": "TrendMicro Legal",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://success.trendmicro.com/en-US/solution/KA-0000017",
        "title": "Reclassifying a URL or website in Trend Micro Site Safety Center"
      },
      {
        "url": "https://success.trendmicro.com/en-US/solution/KA-0003940",
        "title": "Trend Micro product falsely detects a website"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Trend Micro false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Check the affected URL in Site Safety Center and choose Reclassify Request.",
          "Site owners and home users can proceed to URL Reclassification Request; business customers are directed to their support portal.",
          "Choose the proposed safety rating and category, explain your relationship to the site and the reason for review, and enter your email.",
          "Confirm the validation link delivered by email to finish the request."
        ],
        "cautions": [
          "Business customers use the support case category Threat Issue > URL Reclassification.",
          "If the product still detects the site after reclassification, Trend Micro asks for the URL and product web-reputation logs through support."
        ],
        "description": "Trend Micro's Site Safety Center supports website safety-rating and category reclassification."
      },
      {
        "scope": "file",
        "steps": [
          "Record the file SHA-256, filename and exact detection label.",
          "Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.",
          "Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample."
        ],
        "cautions": [],
        "description": "General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.",
        "generalChecklist": true
      }
    ],
    "indexable": true
  },
  {
    "slug": "trustlook",
    "name": "Trustlook",
    "aliases": [
      "Trustlook Antivirus",
      "trustlook",
      "Trustlook"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.trustlook.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:bd@trustlook.com",
        "label": "Trustlook contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "VirusTotal lists this Trustlook contact for reporting a suspected false positive.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email bd@trustlook.com with the VirusTotal report URL, exact Trustlook detection label and SHA-256 of the affected file.",
          "Explain what the file does and why the detection appears incorrect; identify the software publisher and official download location if applicable.",
          "Ask for a false-positive review and follow any instructions returned by the vendor."
        ],
        "cautions": [
          "This contact is listed by VirusTotal. Its current delivery and response behavior have not been independently tested."
        ],
        "description": "VirusTotal lists this Trustlook contact for reporting a suspected false positive."
      }
    ],
    "indexable": true
  },
  {
    "slug": "urlhaus",
    "name": "URLhaus",
    "aliases": [
      "urlhaus",
      "URLHaus"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "form",
        "url": "https://contact.abuse.ch/",
        "label": "abuse.ch false-positive contact form",
        "scope": "url",
        "source": "https://urlhaus.abuse.ch/faq/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:vt-fp@abuse.ch",
        "label": "VirusTotal-listed false-positive email",
        "scope": "url",
        "source": "https://virustotal.readme.io/docs/false-positive-contacts",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://urlhaus.abuse.ch/faq/",
        "title": "URLhaus FAQ"
      },
      {
        "url": "https://contact.abuse.ch/",
        "title": "abuse.ch Contact Center"
      },
      {
        "url": "https://virustotal.readme.io/docs/false-positive-contacts",
        "title": "VirusTotal false-positive contacts"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "URLhaus directs general support to the abuse.ch Contact Center, which includes a false-positive option. VirusTotal also lists a dedicated email.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Open the abuse.ch Contact Center and select Report a false positive.",
          "Provide your name, email, the URLhaus record or affected URL, and an explanation of the incorrect detection.",
          "For a VirusTotal-specific dispute, the email listed by VirusTotal is vt-fp@abuse.ch; include the VirusTotal report link."
        ],
        "cautions": [
          "URLhaus covers malware URLs. Identify the exact record rather than assuming that a domain-wide verdict and one historical URL are the same case."
        ],
        "description": "URLhaus directs general support to the abuse.ch Contact Center, which includes a false-positive option. VirusTotal also lists a dedicated email."
      }
    ],
    "indexable": false
  },
  {
    "slug": "urlquery",
    "name": "URLQuery",
    "aliases": [
      "URLQuery",
      "urlquery"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://urlquery.net/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:contact@urlquery.net",
        "label": "contact@urlquery.net",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find URLQuery false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "varist",
    "name": "Varist",
    "aliases": [
      "Varist",
      "varist"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.varist.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@varist.com",
        "label": "Varist contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      },
      {
        "type": "email",
        "url": "mailto:virus@avsubmit.com",
        "label": "Varist sample contact listed by VirusTotal",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "vt-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal False Positive Contacts"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "VirusTotal lists a support address and a sample-submission address for Varist.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Email support@varist.com with the VirusTotal report URL, exact Varist detection label and SHA-256 of the affected file.",
          "Explain what the file does and why the detection appears incorrect; identify the software publisher and official download location if applicable.",
          "Ask for a false-positive review and follow any instructions returned by the vendor."
        ],
        "cautions": [
          "This contact is listed by VirusTotal. Its current delivery and response behavior have not been independently tested."
        ],
        "description": "VirusTotal lists a support address and a sample-submission address for Varist."
      }
    ],
    "indexable": true
  },
  {
    "slug": "vba32",
    "name": "VBA32",
    "aliases": [
      "VirusBlokAda",
      "vba32",
      "VBA32"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.anti-virus.by/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:feedback@anti-virus.by",
        "label": "feedback@anti-virus.by",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find VBA32 false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "venuseye",
    "name": "Venuseye",
    "aliases": [
      "venuseye",
      "Venuseye"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://www.venuseye.com.cn/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:ti@venuseye.com.cn",
        "label": "Venuseye platform inquiry email",
        "scope": "sandbox",
        "source": "https://www.venuseye.com.cn/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.venuseye.com.cn/",
        "title": "Venuseye platform inquiry email"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "Venuseye publishes a threat-intelligence platform inquiry email in its official contact dialog.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for Venuseye's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "The contact is provided for platform inquiries and consultation; acceptance of a sandbox false-positive case must be confirmed.",
          "The official platform and contact dialog are in Chinese."
        ],
        "description": "Venuseye publishes a threat-intelligence platform inquiry email in its official contact dialog."
      }
    ],
    "indexable": true
  },
  {
    "slug": "viettel-threat-intelligence",
    "name": "Viettel Threat Intelligence",
    "aliases": [
      "Viettel Threat Intelligence",
      "viettel_threat_intelligence"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.viettelcybersecurity.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:cyberthreat@viettel.com.vn",
        "label": "cyberthreat@viettel.com.vn",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Viettel Threat Intelligence false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "vipre",
    "name": "VIPRE",
    "aliases": [
      "ThreatTrack Security",
      "vipre",
      "Vipre",
      "VIPRE"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.threattracksecurity.com/",
    "contacts": [
      {
        "type": "support",
        "url": "https://helpdesk.vipre.com/hc/en-us/requests/new",
        "label": "VirusTotal-listed contact",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find VIPRE false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "viriback",
    "name": "ViriBack",
    "aliases": [
      "viriback"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://viriback.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:me@viriback.com",
        "label": "Published maintainer email (appeal acceptance unconfirmed)",
        "scope": "url",
        "source": "https://keybase.io/viriback/pgp_keys.asc",
        "verification": "source-listed"
      },
      {
        "type": "social",
        "url": "https://keybase.io/viriback",
        "label": "Maintainer Keybase profile (appeal acceptance unconfirmed)",
        "scope": "url",
        "source": "https://keybase.io/viriback",
        "verification": "source-listed"
      },
      {
        "type": "social",
        "url": "https://twitter.com/ViriBack",
        "label": "Maintainer profile (appeal acceptance unconfirmed)",
        "scope": "url",
        "source": "https://viriback.com/",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal netloc engine search prefixes"
      },
      {
        "url": "https://viriback.com/",
        "title": "ViriBack Blog: Official maintainer profile link"
      },
      {
        "url": "https://tracker.viriback.com/",
        "title": "ViriBack C2 Tracker"
      },
      {
        "url": "https://keybase.io/viriback",
        "title": "ViriBack Keybase profile and identity proofs"
      },
      {
        "url": "https://keybase.io/viriback/pgp_keys.asc",
        "title": "Maintainer-published PGP public key"
      },
      {
        "url": "https://keybase.io/_/api/1.0/user/lookup.json?usernames=viriback",
        "title": "Keybase public identity metadata"
      },
      {
        "url": "https://dns.google/resolve?name=viriback.com&type=TXT",
        "title": "Research evidence: dns.google"
      },
      {
        "url": "https://viriback.com/wp-json/wp/v2/pages?per_page=100",
        "title": "Research evidence: viriback.com"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed.",
      "The maintainer publishes me@viriback.com in a public PGP identity associated with the official domain through a matching DNS proof. This is a general maintainer contact, not a dedicated false-positive inbox; delivery, monitoring and acceptance of requests are unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "vendor-published-general",
    "steps": [
      "Use the published maintainer email to ask whether ViriBack accepts a correction request and which channel should receive it.",
      "Suggested details: the exact URL or IP, the VirusTotal report link, the detection date, and a concise explanation of the suspected mistake or completed cleanup.",
      "The maintainer's Keybase profile also offers a chat option. Its acceptance of false-positive requests is unconfirmed."
    ],
    "description": "ViriBack's maintainer publishes me@viriback.com in a public PGP key on Keybase. The Keybase profile links the official domain and Twitter identity. This is a published maintainer email; no dedicated VirusTotal appeal process was verified.",
    "cautions": [
      "The email comes from the maintainer's public-key identity, not an advertised support or false-positive inbox. Delivery, monitoring and appeal acceptance have not been tested.",
      "A public profile or key does not establish that the VirusTotal engine is currently active."
    ],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Use the published maintainer email to ask whether ViriBack accepts a correction request and which channel should receive it.",
          "Suggested details: the exact URL or IP, the VirusTotal report link, the detection date, and a concise explanation of the suspected mistake or completed cleanup.",
          "The maintainer's Keybase profile also offers a chat option. Its acceptance of false-positive requests is unconfirmed."
        ],
        "cautions": [
          "The email comes from the maintainer's public-key identity, not an advertised support or false-positive inbox. Delivery, monitoring and appeal acceptance have not been tested.",
          "A public profile or key does not establish that the VirusTotal engine is currently active."
        ],
        "description": "ViriBack's maintainer publishes me@viriback.com in a public PGP key on Keybase. The Keybase profile links the official domain and Twitter identity. This is a published maintainer email; no dedicated VirusTotal appeal process was verified."
      }
    ],
    "indexable": false,
    "historicalContacts": [],
    "evidenceNotes": [
      {
        "level": "current-primary-source",
        "source": "https://keybase.io/viriback/pgp_keys.asc",
        "observation": "OpenPGP User ID packet contains Viriback <me@viriback.com>. The public key fingerprint is 20bf1807c32ea24fe36429e06305467ddbbf3f4b."
      },
      {
        "level": "current-primary-source",
        "source": "https://keybase.io/viriback",
        "observation": "The self-published profile displays viriback.com DNS and @viriback Twitter identity proofs, plus a Start a chat control."
      },
      {
        "level": "current-dns-observation",
        "source": "https://dns.google/resolve?name=viriback.com&type=TXT",
        "observation": "A direct DNS query returned the Keybase verification token for viriback.com matching this public identity. No email or chat message was sent."
      },
      {
        "level": "current-primary-source",
        "source": "https://viriback.com/wp-json/wp/v2/pages?per_page=100",
        "observation": "The public blog contains only Home/Blog pages; 11 published posts were checked and yielded no additional contact email or appeal workflow."
      }
    ]
  },
  {
    "slug": "virit",
    "name": "VirIT",
    "aliases": [
      "Vir.IT",
      "virit",
      "VirIT"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.tgsoft.it/index.asp",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:virustotal@viritpro.com",
        "label": "virustotal@viritpro.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find VirIT false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "virusdie",
    "name": "Virusdie",
    "aliases": [
      "Virusdie External Site Scan",
      "Virusdie LLC",
      "VirusDie"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://virusdie.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:partners@virusdie.com",
        "label": "partners@virusdie.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Virusdie false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "vmray",
    "name": "VMRay",
    "aliases": [
      "VMRay"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://www.vmray.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://www.vmray.com/contact/customer-support/",
        "label": "VMRay inquiry form for noncustomers",
        "scope": "sandbox",
        "source": "https://www.vmray.com/contact/customer-support/",
        "verification": "vendor-confirmed"
      },
      {
        "type": "email",
        "url": "mailto:support@vmray.com",
        "label": "VMRay customer support",
        "scope": "sandbox",
        "source": "https://www.vmray.com/contact/customer-support/",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://www.vmray.com/contact/customer-support/",
        "title": "VMRay customer support"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Behavioral analysis / sandbox products"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "VMRay directs customers to its support email and provides an inquiry form for people who are not customers.",
    "cautions": [],
    "guides": [
      {
        "scope": "sandbox",
        "steps": [
          "Use the official general contact below and ask for the team responsible for VMRay's VirusTotal result.",
          "Include the VirusTotal report URL, file SHA-256, analysis or task ID, and the disputed behavior or verdict. Explain why the finding appears incorrect.",
          "Ask for a review and follow the support team's instructions for any additional evidence or samples."
        ],
        "cautions": [
          "This is a general contact or support route; a dedicated public false-positive process was not confirmed.",
          "Customer support is the published purpose of the mailbox. Noncustomers should use the form on the linked official customer-support page."
        ],
        "description": "VMRay directs customers to its support email and provides an inquiry form for people who are not customers."
      }
    ],
    "indexable": true
  },
  {
    "slug": "volexity",
    "name": "Volexity",
    "aliases": [
      "Volexity"
    ],
    "scopes": [
      "rules"
    ],
    "website": "https://github.com/volexity/threat-intel",
    "contacts": [
      {
        "type": "repository",
        "url": "https://github.com/volexity/threat-intel",
        "label": "Official rule repository",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/contributors",
        "verification": "source-listed",
        "purpose": "Review the repository contribution/support instructions before reporting a rule match."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      }
    ],
    "notes": [],
    "rosterSections": [
      "YARA rule repositories"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Identify the exact matching rule, rule version and repository from the VirusTotal report.",
      "Read the linked repository README and contribution or support instructions.",
      "Use the maintainer’s published reporting method; include the rule identifier and a reproducible explanation, and avoid posting private samples publicly."
    ],
    "description": "Find Volexity false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "vx-vault",
    "name": "VX Vault",
    "aliases": [
      "VX Vault",
      "vx_vault"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://vxvault.net/ViriList.php",
    "contacts": [
      {
        "type": "social",
        "url": "https://x.com/siri_urz",
        "label": "Maintainer profile (appeal acceptance unconfirmed)",
        "scope": "url",
        "source": "http://siri-urz.blogspot.com",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "http://vxvault.net/ViriList.php",
        "title": "VX Vault: Official Blog link"
      },
      {
        "url": "http://siri-urz.blogspot.com",
        "title": "S!Ri blog: Official Twitter profile link"
      },
      {
        "url": "https://x.com/siri_urz",
        "title": "S!Ri public maintainer profile"
      },
      {
        "url": "https://www.blogger.com/profile/14351408789554155189",
        "title": "Officially linked S!Ri Blogger profile"
      },
      {
        "url": "https://web.archive.org/web/20250426211242/https://siri.geekstogo.com/SmitfraudFix.php",
        "title": "Archived official SmitFraudFix page linked from the maintainer blog"
      }
    ],
    "notes": [
      "The second review confirmed a traceable maintainer profile but found no dedicated form, public email or documented false-positive workflow. Public profiles are excluded from current contact totals."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "public-profile-only",
    "steps": [
      "Use the maintainer profile to look for a current contact option or instructions for VX Vault corrections.",
      "Ask whether the maintainer accepts review requests. Suggested context: the exact affected URL, the VirusTotal report link, and evidence of a mistaken listing or cleanup.",
      "Do not assume a public post or private message will be treated as an appeal; no published review workflow was verified."
    ],
    "description": "VX Vault's website links the S!Ri blog, which links the maintainer's public Twitter account. This is a traceable public profile, not a confirmed false-positive appeal channel.",
    "cautions": [
      "The official website and linked blog were reachable over HTTP during research; HTTPS retrieval failed.",
      "Profile messaging availability and acceptance of appeals remain unconfirmed."
    ],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Use the maintainer profile to look for a current contact option or instructions for VX Vault corrections.",
          "Ask whether the maintainer accepts review requests. Suggested context: the exact affected URL, the VirusTotal report link, and evidence of a mistaken listing or cleanup.",
          "Do not assume a public post or private message will be treated as an appeal; no published review workflow was verified."
        ],
        "cautions": [
          "The official website and linked blog were reachable over HTTP during research; HTTPS retrieval failed.",
          "Profile messaging availability and acceptance of appeals remain unconfirmed."
        ],
        "description": "VX Vault's website links the S!Ri blog, which links the maintainer's public Twitter account. This is a traceable public profile, not a confirmed false-positive appeal channel."
      }
    ],
    "indexable": false,
    "historicalContacts": [],
    "evidenceNotes": [
      {
        "level": "current-primary-source",
        "source": "https://www.blogger.com/profile/14351408789554155189",
        "observation": "The blog-linked public Blogger profile lists the same blog but no email or support contact."
      },
      {
        "level": "current-primary-source",
        "source": "https://x.com/siri_urz",
        "observation": "The current public profile metadata identifies S!Ri and contains no contact email or appeal instructions in its bio."
      },
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20250426211242/https://siri.geekstogo.com/SmitfraudFix.php",
        "observation": "Following the blog-linked official tool website and its meta refresh reaches the SmitFraudFix page. It links back to the same blog but provides no appeal email or form. Tool downloads and donation mechanisms were not treated as contact channels."
      }
    ]
  },
  {
    "slug": "web-security-guard",
    "name": "Web Security Guard",
    "aliases": [
      "Crawler",
      "LLC",
      "Web Security Guard"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributors: Web Security Guard (Crawler, LLC)"
      },
      {
        "url": "http://www.websecurityguard.com/",
        "title": "VT-listed contributor website (unavailable during review)"
      },
      {
        "url": "https://web.archive.org/web/20150105235457/http://www.websecurityguard.com:80/support_help.aspx",
        "title": "Official support form archived January 5, 2015"
      },
      {
        "url": "https://web.archive.org/web/20220816043558/http://www.websecurityguard.com/support_help.aspx",
        "title": "Official support page archived August 16, 2022"
      },
      {
        "url": "https://web.archive.org/web/20250426124915/http://www.websecurityguard.com/",
        "title": "Homepage archive showing expired DNS hosting in April 2025"
      },
      {
        "url": "http://www.websecurityguard.com/support_help.aspx",
        "title": "Research evidence: www.websecurityguard.com"
      }
    ],
    "notes": [
      "No dedicated appeal contact is listed in the VirusTotal false-positive contact table. The contributor website is a research starting point, not a verified appeal channel.",
      "Archived official pages document a historical website-database support form. The live form was unavailable on the review date, so it is retained only in historicalContacts and is excluded from current contact totals."
    ],
    "rosterSections": [
      "Website/domain scanning engines & datasets"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "unresolved",
    "contactStatus": "historical-only",
    "steps": [
      "Save the exact Web Security Guard verdict, current VirusTotal report link, affected URL and detection date.",
      "The historical official support route was support_help.aspx. Check whether the live page has returned before relying on it; it failed during this review.",
      "The historical form requested a name, contact email, subject and comments in English. The archive is evidence of the old process and cannot receive a current appeal."
    ],
    "description": "An archived Web Security Guard support page confirms a historical form for product and website-database questions. Its live URL is currently unavailable. No current email, replacement form or confirmed successor support service was found.",
    "cautions": [
      "The support form is historical, not a verified current submission channel. No current support email was found.",
      "A 2025 homepage archive displayed an expired DNS-hosting notice. That does not prove the company or VirusTotal engine was formally retired."
    ],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Save the exact Web Security Guard verdict, current VirusTotal report link, affected URL and detection date.",
          "The historical official support route was support_help.aspx. Check whether the live page has returned before relying on it; it failed during this review.",
          "The historical form requested a name, contact email, subject and comments in English. The archive is evidence of the old process and cannot receive a current appeal."
        ],
        "cautions": [
          "The support form is historical, not a verified current submission channel. No current support email was found.",
          "A 2025 homepage archive displayed an expired DNS-hosting notice. That does not prove the company or VirusTotal engine was formally retired."
        ],
        "description": "An archived Web Security Guard support page confirms a historical form for product and website-database questions. Its live URL is currently unavailable. No current email, replacement form or confirmed successor support service was found."
      }
    ],
    "indexable": false,
    "historicalContacts": [
      {
        "type": "form",
        "url": "http://www.websecurityguard.com/support_help.aspx",
        "label": "Historical official support form (currently unavailable)",
        "scope": "url",
        "source": "https://web.archive.org/web/20150105235457/http://www.websecurityguard.com:80/support_help.aspx",
        "sourceCapturedAt": "2015-01-05",
        "currentStatus": "website-unreachable",
        "useAsActiveContact": false,
        "note": "The page explicitly invited website-database questions. A 2022 archive retained the support description but no longer exposed form fields. The live URL closed without a response on 2026-10-14."
      }
    ],
    "evidenceNotes": [
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20150105235457/http://www.websecurityguard.com:80/support_help.aspx",
        "observation": "The official support page includes fields for name, email, subject and comments, accepting website-database questions. The address smith@crawler.com is an example field value, not a vendor contact, and was excluded."
      },
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20220816043558/http://www.websecurityguard.com/support_help.aspx",
        "observation": "The support description still exists but form fields are absent from this archived HTML. No independent support-system endpoint was found."
      },
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20250426124915/http://www.websecurityguard.com/",
        "observation": "The page is a DNS Made Easy expired-hosting placeholder. DNS Made Easy support was excluded because it is the infrastructure provider, not the Web Security Guard appeals team."
      },
      {
        "level": "current-observation",
        "source": "http://www.websecurityguard.com/support_help.aspx",
        "observation": "The live URL closed the HTTP connection without a response. Current Crawler/PCRx/Spyware Terminator routes also failed retrieval; no successor relationship was established."
      }
    ],
    "historicalWebsite": "http://www.websecurityguard.com/"
  },
  {
    "slug": "webroot",
    "name": "Webroot",
    "aliases": [
      "Webroot",
      "webroot"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.webroot.com/",
    "contacts": [
      {
        "type": "form",
        "url": "https://support.threatintel.opentext.com/tools/change-request.php",
        "label": "URL category and reputation change request",
        "scope": "url",
        "source": "https://support.threatintel.opentext.com/tools/change-request.php",
        "verification": "vendor-confirmed"
      },
      {
        "type": "form",
        "url": "https://snup.webrootcloudav.com/SkyStoreFileUploader/upload.aspx",
        "label": "Webroot file false-positive submission",
        "scope": "file",
        "source": "https://answers.webroot.com/Webroot/ukp.aspx?app=vw&pid=17&solutionid=1839&t=False-positive-vendor&vw=1",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://mysupport.webrootanywhere.com/supportwelcome.aspx",
        "label": "Webroot support ticket",
        "scope": "file",
        "source": "https://answers.webroot.com/Webroot/ukp.aspx?app=vw&pid=17&solutionid=1839&t=False-positive-vendor&vw=1",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://support.threatintel.opentext.com/tools/change-request.php",
        "title": "OpenText Threat Intelligence (BrightCloud) change request"
      },
      {
        "url": "https://answers.webroot.com/Webroot/ukp.aspx?app=vw&pid=17&solutionid=1839&t=False-positive-vendor&vw=1",
        "title": "Webroot false-positive guidance for software vendors"
      },
      {
        "url": "https://snup.webrootcloudav.com/SkyStoreFileUploader/upload.aspx",
        "title": "Webroot File Submission"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Webroot false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Enter the URL or domain and your email address in the OpenText change-request form.",
          "Optionally suggest an appropriate category and identify the product or integration showing the result.",
          "Use the comments field to explain the classification problem, then submit."
        ],
        "cautions": [
          "The current comments field is limited to 150 characters.",
          "Use a simple, accurate URL and make sure reviewers can reach its content.",
          "A site's category and reputation are distinct, and local security-product policies can still block a category."
        ],
        "description": "The BrightCloud URL reputation and category review form now operates under OpenText Threat Intelligence."
      },
      {
        "scope": "file",
        "steps": [
          "Open the Webroot file-submission page and select False Positive detection as the reason.",
          "Provide the affected file or its hash and the requested context, then complete the CAPTCHA and submission terms.",
          "For a ticket with a contact email, use Webroot support and include the VirusTotal report URL, exact detection and software details."
        ],
        "cautions": [
          "These are file-review routes. Webroot's URL reputation change form is a separate process."
        ],
        "description": "Webroot provides a file-submission form and support-ticket route for developers disputing a file detection."
      }
    ],
    "indexable": true
  },
  {
    "slug": "whitearmor",
    "name": "WhiteArmor",
    "aliases": [
      "whitearmor",
      "Babable"
    ],
    "scopes": [
      "file"
    ],
    "website": "",
    "contacts": [],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://blog.virustotal.com/2016/11/virustotal-whitearmor.html",
        "title": "VirusTotal welcomes WhiteArmor and links its original website"
      },
      {
        "url": "https://web.archive.org/web/20160812170632/http://www.wangav.com:80/",
        "title": "Original WhiteArmor company homepage captured August 12, 2016"
      },
      {
        "url": "https://web.archive.org/web/20170817100946/http://www.whitearmor.ai:80/",
        "title": "WhiteArmor AI company homepage captured August 17, 2017"
      },
      {
        "url": "https://web.archive.org/web/20171019061410/http://www.whitearmor.ai:80/",
        "title": "WhiteArmor engine-cooperation contact captured October 19, 2017"
      },
      {
        "url": "https://web.archive.org/web/20180628021807/http://babable.com/",
        "title": "Official Babable rebrand statement captured June 28, 2018"
      },
      {
        "url": "https://dns.google/resolve?name=whitearmor.ai&type=MX",
        "title": "Google Public DNS lookup for WhiteArmor MX"
      },
      {
        "url": "https://cloudflare-dns.com/dns-query?name=whitearmor.ai&type=MX",
        "title": "Cloudflare DNS lookup for WhiteArmor MX"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "The official 2016 VirusTotal announcement links to wangav.com. That domain is currently parked/offered for sale. No current primary-source support channel was verified.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed.",
      "The archived official Babable homepage confirms that WhiteArmor rebranded to Babable. Both VirusTotal engine-prefix records are preserved because the brand relationship does not establish current engine activity or support.",
      "Recovered historical email addresses are evidence of earlier company contact details; none is verified as a current appeal channel."
    ],
    "rosterSections": [
      "File vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "unresolved",
    "contactStatus": "historical-only",
    "steps": [
      "Re-analyse the existing VirusTotal report and record the exact WhiteArmor detection and result date.",
      "Use the documented Babable rebrand when searching for a later owner or existing business correspondence.",
      "Treat the recovered email addresses as historical evidence only. A Gmail address was published by the vendor in 2016, but its current owner, activity and review process are unconfirmed."
    ],
    "description": "WhiteArmor's official website archives reveal historical email addresses and its later rebrand to Babable. No current direct false-positive channel was verified.",
    "cautions": [
      "The historical website linked by VirusTotal, wangav.com, is now parked or offered for sale. It must not be presented as an active vendor support destination.",
      "The old whitearmor.ai email domain returned NXDOMAIN from two independent DNS resolvers in this audit.",
      "The archived Gmail address has not been tested, and the existence of Gmail as a service does not verify that this individual mailbox is active or still controlled by the vendor.",
      "No evidence was found of a current false-positive process or a successor beyond Babable."
    ],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Re-analyse the existing VirusTotal report and record the exact WhiteArmor detection and result date.",
          "Use the documented Babable rebrand when searching for a later owner or existing business correspondence.",
          "Treat the recovered email addresses as historical evidence only. A Gmail address was published by the vendor in 2016, but its current owner, activity and review process are unconfirmed."
        ],
        "cautions": [
          "The historical website linked by VirusTotal, wangav.com, is now parked or offered for sale. It must not be presented as an active vendor support destination.",
          "The old whitearmor.ai email domain returned NXDOMAIN from two independent DNS resolvers in this audit.",
          "The archived Gmail address has not been tested, and the existence of Gmail as a service does not verify that this individual mailbox is active or still controlled by the vendor.",
          "No evidence was found of a current false-positive process or a successor beyond Babable."
        ],
        "description": "WhiteArmor's official website archives reveal historical email addresses and its later rebrand to Babable. No current direct false-positive channel was verified."
      }
    ],
    "indexable": false,
    "historicalContacts": [
      {
        "type": "email",
        "url": "mailto:wangavcom@gmail.com",
        "label": "Historical vendor-published contact — wangavcom@gmail.com",
        "scope": "file",
        "source": "https://web.archive.org/web/20160812170632/http://www.wangav.com:80/",
        "sourceCapturedAt": "2016-08-12",
        "currentStatus": "mailbox-ownership-and-activity-unconfirmed",
        "useAsActiveContact": false,
        "note": "The original WhiteArmor homepage used this as its general eMail link. It is not verified as a current false-positive address."
      },
      {
        "type": "email",
        "url": "mailto:obu@whitearmor.ai",
        "label": "Historical vendor-published contact — obu@whitearmor.ai",
        "scope": "file",
        "source": "https://web.archive.org/web/20170817100946/http://www.whitearmor.ai:80/",
        "sourceCapturedAt": "2017-08-17",
        "currentStatus": "domain-nxdomain",
        "useAsActiveContact": false,
        "note": "Published by the WhiteArmor company homepage; the October 19, 2017 capture identifies it as an AI antivirus-engine cooperation contact."
      },
      {
        "type": "email",
        "url": "mailto:obu@babable.com",
        "label": "Historical vendor-published contact — obu@babable.com",
        "scope": "file",
        "source": "https://web.archive.org/web/20180628021807/http://babable.com/",
        "sourceCapturedAt": "2018-06-28",
        "currentStatus": "domain-nxdomain",
        "useAsActiveContact": false,
        "note": "Published after WhiteArmor announced that it had rebranded to Babable."
      }
    ],
    "evidenceNotes": [
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20160812170632/http://www.wangav.com:80/",
        "observation": "The WhiteArmor homepage has a general eMail link to wangavcom@gmail.com. Its 2016 privacy-policy page uses the same mailbox for privacy questions."
      },
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20171019061410/http://www.whitearmor.ai:80/",
        "observation": "The official page publishes obu@whitearmor.ai for cooperation on its AI antivirus engine."
      },
      {
        "level": "archived-primary-source",
        "source": "https://web.archive.org/web/20180628021807/http://babable.com/",
        "observation": "The vendor confirms that WhiteArmor became Babable. This resolves the historical identity relationship but does not establish current support."
      },
      {
        "level": "current-dns-observation",
        "source": "https://dns.google/resolve?name=whitearmor.ai&type=MX",
        "observation": "MX, A and NS returned DNS Status 3 (NXDOMAIN); Cloudflare independently returned NXDOMAIN for MX."
      }
    ],
    "relatedVendors": [
      {
        "slug": "babable",
        "name": "Babable",
        "relationship": "later-name",
        "source": "https://web.archive.org/web/20180628021807/http://babable.com/"
      }
    ]
  },
  {
    "slug": "withsecure",
    "name": "WithSecure",
    "aliases": [
      "WithSecure"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.withsecure.com/",
    "contacts": [
      {
        "type": "support",
        "url": "https://elements.withsecure.com",
        "label": "WithSecure Elements sample validation",
        "source": "https://community.withsecure.com/en/kb/articles/29360-how-to-submit-a-false-positive-or-negative-sample-file-or-url-to-withsecure",
        "scope": "file",
        "verification": "vendor-confirmed"
      },
      {
        "type": "support",
        "url": "https://community.withsecure.com/en/kb/articles/29360-how-to-submit-a-false-positive-or-negative-sample-file-or-url-to-withsecure",
        "label": "Current WithSecure submission instructions",
        "source": "https://community.withsecure.com/en/kb/articles/29360-how-to-submit-a-false-positive-or-negative-sample-file-or-url-to-withsecure",
        "scope": "file",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      },
      {
        "url": "https://community.withsecure.com/en/kb/articles/29360-how-to-submit-a-false-positive-or-negative-sample-file-or-url-to-withsecure",
        "title": "How to submit a false positive or negative sample file or URL to WithSecure"
      }
    ],
    "notes": [
      "F-Secure consumer products and WithSecure business products have separate review channels.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "False positive contacts"
    ],
    "status": "contact-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Open the linked contact or support page and follow its current false-positive submission instructions.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "WithSecure's current sample review workflow is available in the signed-in Elements portal.",
    "cautions": [],
    "guides": [
      {
        "scope": "file",
        "steps": [
          "Sign in to Elements, open Requests and choose Create Request.",
          "Select Submit sample for validation, then File and the appropriate false-positive or PUA category.",
          "Upload the file, choose the request reason and affected product, and provide a title and description.",
          "Create the request and track the review in the portal."
        ],
        "cautions": [
          "The former public Submit a Sample link now redirects to instructions for the Elements workflow.",
          "F-Secure consumer products have a separate public form. Do not assume that older combined F-Secure/WithSecure contacts represent both current workflows."
        ],
        "description": "WithSecure's current sample review workflow is available in the signed-in Elements portal."
      }
    ],
    "indexable": false
  },
  {
    "slug": "xcitium-comodo",
    "name": "Xcitium / Comodo",
    "aliases": [
      "Comodo",
      "Xcitium",
      "Comodo Valkyrie Verdict",
      "Comodo Group",
      "xcitium_verdict_cloud",
      "comodo",
      "Xcitium Verdict Cloud (Comodo)"
    ],
    "scopes": [
      "file",
      "url"
    ],
    "website": "http://www.comodo.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@xcitium.com",
        "label": "support@xcitium.com",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Antivirus products",
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Xcitium / Comodo false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "yandex",
    "name": "Yandex",
    "aliases": [
      "yandex",
      "Yandex"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.yandex.ru/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:yandex-antivir@support.yandex.ru",
        "label": "yandex-antivir@support.yandex.ru",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Yandex false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "yandex-safe-browsing",
    "name": "Yandex Safe Browsing",
    "aliases": [
      "Yandex Safebrowsing",
      "Yandex",
      "yandex_safebrowsing"
    ],
    "scopes": [
      "url"
    ],
    "website": "http://www.yandex.ru/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:sbapi@support.yandex.ru",
        "label": "sbapi@support.yandex.ru",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "Netloc vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Yandex Safe Browsing false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "yomi-yoroi",
    "name": "Yomi / Yoroi",
    "aliases": [
      "Yomi Hunter",
      "Yoroi",
      "Yomi"
    ],
    "scopes": [
      "sandbox"
    ],
    "website": "https://blog.yoroi.company/announcement/yoroi-welcomes-yomi-the-malware-hunter/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:yomi-false-positives@yoroi.company",
        "label": "yomi-false-positives@yoroi.company",
        "scope": "all",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed",
        "scopeNote": "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [
      "VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result."
    ],
    "rosterSections": [
      "Behavioral analysis / sandbox products",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Yomi / Yoroi false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "zerocert",
    "name": "ZeroCERT",
    "aliases": [
      "zerocert"
    ],
    "scopes": [
      "url"
    ],
    "website": "",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:hello@zerocert.org",
        "label": "ZeroCERT general inquiries",
        "scope": "url",
        "source": "https://www.zerocert.org/?act=what-is",
        "verification": "vendor-confirmed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/list-netloc-engines",
        "title": "VirusTotal network engine prefixes"
      },
      {
        "url": "https://www.zerocert.org/?act=what-is",
        "title": "ZeroCERT: About and Contact Us"
      }
    ],
    "notes": [
      "Listed in VirusTotal search-prefix documentation but absent from the contributor roster snapshot; this is not proof the engine is currently active.",
      "This name appears in a VirusTotal engine-prefix list or contact table but is not matched to a current contributor entry. Current engine activity is unconfirmed."
    ],
    "rosterSections": [
      "Netloc vendor prefixes"
    ],
    "status": "prefix-only",
    "verifiedAt": "2026-10-14",
    "verification": "vendor-confirmed",
    "contactStatus": "vendor-confirmed",
    "steps": [
      "Check the linked contributor website for its current support or security contact.",
      "Ask which team reviews VirusTotal false positives for your indicator type; provide the report link, exact detection label and evidence of the suspected mistake.",
      "A dedicated appeal process for this entry has not yet been established."
    ],
    "description": "ZeroCERT's official About page publishes a general inquiry email. No dedicated false-positive form or documented VirusTotal appeal workflow was verified.",
    "cautions": [],
    "guides": [
      {
        "scope": "url",
        "steps": [
          "Email the published general inquiry address and ask for a review of the ZeroCERT classification.",
          "Suggested details: the exact domain or URL, the VirusTotal report link, the displayed detection, and a concise explanation of why the site is legitimate or what was cleaned up.",
          "Ask for the correct review channel if the general inquiry team cannot process the request."
        ],
        "cautions": [
          "This is a general contact address, not a confirmed dedicated false-positive queue.",
          "The source page is in Korean."
        ],
        "description": "ZeroCERT's official About page publishes a general inquiry email. No dedicated false-positive form or documented VirusTotal appeal workflow was verified."
      }
    ],
    "indexable": false
  },
  {
    "slug": "zerofox",
    "name": "ZeroFox",
    "aliases": [
      "ZeroFox"
    ],
    "scopes": [
      "url"
    ],
    "website": "https://www.zerofox.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:ask@zerofox.com",
        "label": "ask@zerofox.com",
        "scope": "url",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Website/domain scanning engines & datasets",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find ZeroFox false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "zillya",
    "name": "Zillya",
    "aliases": [
      "Zillya!",
      "zillya",
      "Zillya"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://zillya.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:support@zillya.com",
        "label": "support@zillya.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Zillya false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "zonealarm",
    "name": "ZoneAlarm",
    "aliases": [
      "Check Point Software Technologies",
      "ZoneAlarm by Check Point",
      "zonealarm",
      "ZoneAlarm"
    ],
    "scopes": [
      "file"
    ],
    "website": "https://www.checkpoint.com/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:zonealarm_VT_reports@checkpoint.com",
        "label": "zonealarm_VT_reports@checkpoint.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find ZoneAlarm false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  },
  {
    "slug": "zoner",
    "name": "Zoner",
    "aliases": [
      "Zoner Antivirus",
      "zoner",
      "Zoner"
    ],
    "scopes": [
      "file"
    ],
    "website": "http://www.zonerantivirus.cz/",
    "contacts": [
      {
        "type": "email",
        "url": "mailto:false@zonerantivirus.com",
        "label": "false@zonerantivirus.com",
        "scope": "file",
        "source": "https://docs.virustotal.com/docs/false-positive-contacts",
        "verification": "source-listed"
      }
    ],
    "sources": [
      {
        "url": "https://docs.virustotal.com/docs/contributors",
        "title": "VirusTotal contributor roster"
      },
      {
        "url": "https://docs.virustotal.com/docs/list-file-engines",
        "title": "VirusTotal file engine prefixes"
      },
      {
        "url": "https://docs.virustotal.com/docs/false-positive-contacts",
        "title": "VirusTotal official false-positive contact list"
      }
    ],
    "notes": [],
    "rosterSections": [
      "Antivirus products",
      "File vendor prefixes",
      "False positive contacts"
    ],
    "status": "roster-listed",
    "verifiedAt": "2026-10-14",
    "verification": "source-listed",
    "contactStatus": "source-listed",
    "steps": [
      "Re-scan the affected item in VirusTotal to confirm that the named engine still detects it.",
      "Email the VirusTotal-listed contact and request a false-positive review.",
      "Include the VirusTotal report link, exact indicator, detection name, why you believe the verdict is wrong and any cleanup evidence. Confirm that the team handles your indicator type.",
      "Wait for the vendor’s decision and re-scan after a correction. Keep the case reference for any follow-up."
    ],
    "description": "Find Zoner false-positive contact details and a practical checklist for requesting a review of a VirusTotal detection.",
    "cautions": [],
    "guides": [],
    "indexable": true
  }
]