Report a false positive

Last updated 2026-10-09

If something on our lists is blocking a site or service you rely on, or you own a domain or address that shouldn't be there, we want to know.

First: unblock it on your side

Don't wait for us. Add an exception or allow-list entry in your own tool, or switch the list back to alert-only mode, so your work isn't held up. Then tell us, so we can fix it for everyone.

How to report it

Email **falsepositive@watchmanhq.com** with:

1. the entry, exactly as it appears in the list (for example example.com or 203.0.113.7);
2. which list it was on (Confident, Blocking or Hunting) and, if you know it, the release id;
3. why you think it's wrong (for example "this is our payroll provider" or "we own this domain and it was cleaned up in March"); and
4. anything that helps us check, such as a link or a screenshot. If you own the domain or address, saying so is enough to start.

There's no form, on purpose: forms are a favorite target for attackers and spam, and we keep this site as small and locked down as we can.

What we do

• We remove first and investigate after. If a report looks plausible, the entry comes off the lists in the next release, and only then do we look into it.
• We tell the collector, not just the list. Removals go into the rules that build every release, so the same entry doesn't come back tomorrow from the same reports.
• We may tell the original researchers if their report seems to be the cause, so the fix spreads further than our lists.
• We don't promise a response time. This is a free, volunteer-run project. Reports are a priority, and we act as soon as we can, but there's no service-level agreement.

Things that limit the damage while you wait

• Every list expires 72 hours after it's built. If our updates ever stopped, correctly set-up tools would stop enforcing the old list.
• Entries age out on their own: IP addresses after 30 days, domains and URLs after 90 days, counted from the first report. A new mention doesn't reset the clock.
• Popular sites, major cloud and CDN addresses, identity providers and other critical services can never appear on the block lists. See Methodology.

If you own a listed domain or address

An entry means a published security report described your domain or address as connected with malicious activity at some point. It isn't an accusation by us, and often the owner is a victim: websites get hacked, and addresses get reassigned. Email us and we will take it off. If your site was compromised, it may be worth telling the researcher who reported it too, so their report can be updated.