Sophos false positive?
Here’s where to start.
Sophos false-positive review channels for websites / URLs and files. Find contact scope, review guidance, source links, and any limits to the available process.
Appeal contacts
Choose a channel for the type of detection you want reviewed. Contact availability and acceptance are controlled by the vendor.
How to request a review
Website / URL review
Sophos accepts URL reassessment requests for malware detections and incorrect website classifications.
- Open the Submit a Sample page and select Web Address (URL).
- Enter the affected URL, your contact details, the Sophos product or service, and the reason for reassessment.
- Complete the required fields and select Submit URL.
- For non-customers, Sophos asks which product caused the warning. If that cannot be established, its guidance allows the best available guess in the required Product/Services field.
- An organization's web-control policy may block a category even when the classification is accurate.
File review
General preparation checklist. A separate vendor-specific workflow for this report type has not been independently checked.
- Record the file SHA-256, filename and exact detection label.
- Use a listed contact that accepts this indicator type. If the listed route handles a different type, ask the vendor or project for the responsible review team.
- Explain why the detection appears incorrect and include supporting evidence. Follow the recipient’s instructions before sending a sample.
Scope & contact notes
- VirusTotal does not specify an indicator type for this contact. Confirm that the recipient handles your exact file, URL or rule result.
Names you may see in a report
Aliases help locate the responsible vendor. Related products can use different submission channels; check the scope shown above.
Sources for this entry
- VirusTotal contributor roster ↗
- VirusTotal network engine prefixes ↗
- VirusTotal file engine prefixes ↗
- VirusTotal official false-positive contact list ↗
- Sophos Endpoint: website is blocked or has restricted access ↗
“Guidance checked” means a public vendor source supports the route or instructions. We have not sent a test appeal or verified mailbox delivery. Read our methodology.