First, what is eGambit?
eGambit is the scanning engine of TEHTRIS, a company based in Bordeaux, France. VirusTotal announced it in October 2017 as an artificial intelligence module aimed at unknown Windows malware, so its verdict shows up whenever someone scans your URL or file on VirusTotal.
TEHTRIS itself sells endpoint detection and response (EDR) software for workstations and servers. Its own pages do not describe how eGambit rates a website, so we cannot say more about the way it reaches a verdict on a URL.
Who can't reach you right now
Where it's used, and who shares it
These engines are independent from eGambit. If they flag you too, each one needs its own request:
Google Safe Browsing →
Kaspersky →
ESET →
Bitdefender →How to tell if you're flagged
VirusTotal. Scan the URL and look for the eGambit row. It shows the verdict TEHTRIS holds for your site, and the same scan shows whether other engines agree.- User reports. Ask affected users for a screenshot of the warning and the address of the page they tried to open. TEHTRIS has no public lookup tool that we could find.
Asking eGambit to fix it
Find the eGambit row on VirusTotal
Open virustotal.com, choose the URL tab and paste the full address of the flagged page. Find the eGambit row and note its verdict. Copy the link of the report from your browser, because the email needs it. No account is needed.
Check that it is a mistake
Scan your server for files you did not upload, and check every page for hidden scripts or redirects to other sites. Look at pages that ask visitors for a password or card number too. Fix anything you find first, and write to TEHTRIS only when the site is clean.
Send the email
The address comes from VirusTotal's list of vendor contacts at docs.virustotal.com/docs/false-positive-contacts. We found no web form on the TEHTRIS site: the old form page at tehtris.com/egambit_fp.php, which an earlier copy of the list names, returns a 404 error. Write to [email protected]. You need no account, and any email address works, so a company address is not required. Put the full URL, the VirusTotal report link, who owns the site and what the site does in the body.
To: virus[at]tehtris[.]com Subject: False positive: hxxps://example[.]com flagged as phishing by eGambit Hello, VirusTotal shows eGambit flagging hxxps://example[.]com as phishing. Report: hxxps://www[.]virustotal[.]com/gui/url/<id> I run this site for my bakery, Example Bakery. I own the domain and I host the site myself. Visitors can read the menu and send an order enquiry through a form that posts to our own server. There is no login, no download and no payment page. Please review the verdict and remove the detection. Thank you, Name
Wait, then reanalyse
The pages we opened state no turnaround, so we give none. After a while, open your VirusTotal report and click Reanalyze. The eGambit row shows the verdict it holds now. If it has not changed, write again in the same email thread.