VENDOR APPEAL GUIDE
Abuse.ch SSLBL false positive?
Here’s where to start.
abuse.ch provides a contact form with a false-positive reporting category for its threat-data projects.
Appeal contacts
Choose a channel for the type of detection you want reviewed. Contact availability and acceptance are controlled by the vendor.
abuse.ch false-positive contact formOpen submission page · Detection rules↗
Source: Vendor / project documentation · Guidance checked
How to request a review
Detection rules review
abuse.ch provides a contact form with a false-positive reporting category for its threat-data projects.
- Open the abuse.ch contact form and choose Report a false positive.
- Identify SSLBL and include the exact listed certificate fingerprint, JA3 fingerprint or IP address, the rule ID if applicable, and the VirusTotal report link.
- Explain the legitimate use and why the match is incorrect, enter your contact details, and complete the CAPTCHA.
- Identify the affected abuse.ch project so the report can be routed correctly.
Names you may see in a report
Abuse.ch SSLBLAbuse.ch Blocklists: C2, JA3, SSLAbuse.ch
Aliases help locate the responsible vendor. Related products can use different submission channels; check the scope shown above.
Sources for this entry
“Guidance checked” means a public vendor source supports the route or instructions. We have not sent a test appeal or verified mailbox delivery. Read our methodology.