First, what is Sophos?
Sophos sells endpoint and firewall security, mostly to companies. Its products block a website in one of two ways. A malware detection marks the page or file as dangerous, and Sophos has to reassess it. A category policy blocks a whole category of sites.
The fix is different for each. If the block comes from a detection, you ask Sophos to reassess the site or file. If your site sits in the wrong category, you ask Sophos to recategorize it. If the company administrator chose to block the category and your site is in the right one, the block is the company's own choice, and only that administrator can lift it.
Who can't reach you right now
Where it's used, and who shares it
Sophos does not list the partner products, so we cannot name them. If the block shows up in a product from another brand, follow the instructions of that brand first. Sophos tells customers of its OEM partners to do the same.
These engines are independent from Sophos. If they flag you too, each one needs its own request:
Kaspersky →
ESET →
Bitdefender →
Microsoft Defender →How to tell if you're flagged
Sophos Intelix (intelix.sophos.com). Guest mode works without an account. Enter your URL or upload a file to see the verdict Sophos holds for it.
VirusTotal. Scan the URL or file and find the Sophos row. The same scan shows whether other engines flag you too.- User reports. Ask affected users which Sophos product they use and for a screenshot of the block page. It shows the detection name or the category.
ML/PE-AThe deep learning engine judged a Windows program malicious before it ran.Generic ML PUAThe same engine judged the program a potentially unwanted application.Mal/HTMLGen-AThe name Sophos shows on a "High Risk Website Blocked" page.Asking Sophos to fix it
Collect the details
Write down which Sophos product raised the block, the detection name or the category the block page shows, and the full URL. For a file, also keep the file and note its name and version.
Check that it is a mistake
Look the URL up on Intelix first. If the block page names a detection, scan your server and scripts for injected code, and rebuild files from clean source. If it names a category, check whether the category is wrong or whether the company administrator blocked that category on purpose. Only a wrong category or a wrong detection is a mistake you can report.
Report a website by email
Sophos gives this route in its article Sample Submission - Non-Customer File and URL submissions, and says submissions are welcome from anyone. Send the email to [email protected]. Make the subject the URL that Sophos has miscategorized, with "http:" replaced by "hxxp:" and "https:" replaced by "hxxps:". In the body, write a concise explanation of the wrong categorization and the category you believe is correct. You need no account, and the address does not ask for a company email, so a personal address is fine.
To: url_review[at]labs[.]sophos[.]com
Subject: hxxps://example[.]com/page
Body: hxxps://example[.]com is the website of our company,
Example Ltd. Sophos blocks it as a high risk website.
We own the domain and run the site ourselves. The
site sells accounting software and offers nothing
to download. We believe the correct category is
<category you believe is right>. Please review the
verdict.
Report a file by email
Send the sample to [email protected]. Put the file in a ZIP archive protected with the password "infected". Include the product or service name and version, the detection name, a subject that sums up the misclassification, and a description. Sophos says: "Feedback will not be provided."
To: samples[at]sophos[.]com
Subject: False positive: Example App 2.1 detected as ML/PE-A
Attach: example-app-setup.zip (password: infected)
Body: Product: <Sophos product and version>
Detection name: ML/PE-A
This file is the installer of our product Example App 2.1.
Sophos detects it as malware. We built it from our own
source. The official download page is
hxxps://example[.]com/download. Please review the verdict.
Wait and check the result
Sophos says it reviews a URL recategorisation "as quickly as possible, though it may take up to five business days once a site has been re-classified for it to be available on your Sophos product". Look the URL or file up on Intelix again, and scan it on VirusTotal. Ask affected users to try again.
Other ways to report
Sophos explains its own rules for false positives on these pages: