Fortinet false positive?
Here’s where to start.
Fortinet false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.
Appeal contacts
Choose a channel for the type of detection you want reviewed. Contact availability and acceptance are controlled by the vendor.
How to request a review
Website / URL review
FortiGuard offers separate review routes for malicious URL database entries and web-filter categories.
- For a malicious URL verdict, open the Malicious URL Database form and provide the affected URL and the relevant detection details.
- For a category error, look up the address in FortiGuard Web Filter Lookup, choose Request a Review, and suggest the appropriate category.
- Include a screenshot of the block message when available.
- Use the malicious-URL route for a security verdict and the category-review route for an incorrect web category.
File review
General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.
- Record the file SHA-256, filename and exact detection label.
- Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.
- Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample.
Scope & contact notes
- VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result.
Names you may see in a report
Aliases help locate the responsible vendor. Related products can use different submission channels; check the scope shown above.
Sources for this entry
- VirusTotal contributor roster ↗
- VirusTotal network engine prefixes ↗
- VirusTotal file engine prefixes ↗
- VirusTotal official false-positive contact list ↗
- FortiGuard frequently asked questions ↗
- FortiGuard webfilter re-categorization ↗
“Guidance checked” means a public vendor source supports the route or instructions. We have not sent a test appeal or verified mailbox delivery. Read our methodology.