If Shelltrap flagged a file that is genuinely fine, send it to us. Confirmed false positives are released for everyone in the next signed signature generation, so one report helps every server running Shelltrap.
Where to send it
E-mail falsepositive@shelltrap.com from the e-mail address registered in your client area. Only reports from registered customers are processed — an address we cannot match to a licence is not answered.
What the message must contain
- the finding ID from
shelltrap findings listor from the plugin, - the rule or signature name shown in the finding,
- the SHA-256 of the file,
- and the file itself as an attachment —
.php,.txtor.zip, at most 2 MB.
Getting the hash:
sha256sum /path/to/file.php
shelltrap findings show <id>Without the file we can record the report, but we cannot clear the hash — the release is by SHA-256, so we need the exact bytes.
What happens then
The report is checked automatically. Your sample is re-scanned against the current signature generation, and an AI analysis runs on Panomity's own GPU hardware in Munich. Two hard rules apply on top of that: ClamAV hits and hash-set hits are never released automatically. Those go to a human.
You normally get an answer from sentinel@shelltrap.com within an hour.
What a confirmed false positive changes
The file is released by its SHA-256 in the next signed signature generation. That generation is published immediately, and every server picks it up automatically at its next feed refresh — no action needed on your side beyond the normal feed interval. Tightening the rule that misfired follows later, as a separate change, because a fast allowlist entry and a careful rule edit are two different pieces of work.
If you want the update sooner than the next scheduled refresh:
shelltrap feeds update
shelltrap feeds listUnclear cases
If the sample is ambiguous, or if the file cannot be sent for legal or privacy reasons, open a ticket in the client area instead and describe the case. We would rather have a conversation than guess.
In the meantime
Restore the file from quarantine if you need it back, and add a narrow ignore rule — by hash, on the affected domain — if you need immediate quiet. Remove that rule once the new generation has arrived.