topic Re: False positive: https://calculatorstudio.co and https://app.calculatorstudio.co in VirusTotal

False positive: https://calculatorstudio.co and https://app.calculatorstudio.co

alexandra — Thu, 19 Dec 2024 10:00:29 GMT

Hi there, we are not Palo Alto Networks customers but some of our customers are and they are getting false positives on our domain https://calculatorstudio.co

Please advise on how we can go about getting this resolved.

Re: False positive: https://calculatorstudio.co and https://app.calculatorstudio.co

CosminM — Fri, 20 Dec 2024 11:30:09 GMT

Hello @alexandra ,

Every Palo Alto Networks customer can check the categories of a specific URL by entering the URL into a Test A Site, our URL lookup engine. If the customer consider a URL is incorrectly categorized, submit a category change request.

Another option is to create a custom URL category to exclude particular websites from category-based enforcement.

Re: False positive: https://calculatorstudio.co and https://app.calculatorstudio.co

kiwi — Fri, 20 Dec 2024 12:08:41 GMT

Hi @alexandra ,

If url-categorisation is the issue please follow the guidance from @CosminM
In case your customer is getting threat alerts, then have them grab the PCAPs in the threat logs (might have to be activated) and submit to TAC for analysis.

Kind regards,

-Kim.

Re: False positive: https://calculatorstudio.co and https://app.calculatorstudio.co

alexandra — Mon, 23 Dec 2024 12:10:35 GMT

Thank you both for your reply. So as I understand it, there is nothing that I can do?

I've instructed my customers to submit the reports as suggested here but with other providers, I've been able to submit a false positive report myself and was hoping I'd be able to do the same with Palo Alto and get ahead of this on my customers' behalf. But I have instructed them as suggested and hopefully this will be resolved soon as this impacts not only them but their own customers. Thanks again!