How to report a VirusTotal false positive

Start with the individual result

A VirusTotal report combines results from independent engines. Find the vendor name beside the result you want reviewed. A small number of detections does not, by itself, establish that a file or website is safe.

Before appealing, use the report’s reanalysis option where available. If the result persists, collect the precise engine name, detection label, report link, and the affected URL or file hash.

Match the indicator to the right team

A domain reputation team may not accept file samples, and an antivirus sample mailbox may not handle website categorization. Use the detection-type filter in this directory, then read the scope on the vendor page.

Some companies appear under several engine names. Search both the displayed engine and its parent company. Google’s file engine and Google Safe Browsing, for example, have separate entries here.

Send a specific request

State what was flagged, why you believe the result is wrong, and what evidence supports a review. If you fixed a compromise, describe the fixes honestly. Include the exact URL rather than only the homepage when the detection concerns a particular page.

Submit through the vendor’s official route. Keep its confirmation and case number so you can follow up in the same thread. This directory does not submit appeals for you.

After the vendor reviews it

Check the vendor’s own lookup service if one is available, then reanalyze the VirusTotal report. URL results can be cached. If the vendor confirms removal but VirusTotal still shows the old URL result, provide that confirmation to VirusTotal support. There is no universal clearance deadline.