The Talos Security Intelligence system seems to suffer an issue in which a site can be placed exclusively on the Talos Intelligence Block List and a ticket is not able to be submitted because the system correctly identifies that the site should not be blocked, despite it's actual status on the block list. Reputation tickets are immediately closed with the following response:
"This case was resolved by automation due to the submission already having a non-blocking score. By default, a URL/IP address with a Web Reputation of Trusted, Favorable, Neutral, or Questionable should be accessible by our customers. Talos does not improve the reputation of already accessible submissions as this would affect the way our automated system functions. If one of our customers cannot access the submission, that is due to aggressive settings on their side and can only be fixed locally by that customer. If you would like this to be reviewed further, please open a TAC case."
Unfortunately it does not seem possible to open a TAC case without an active contract with Cisco, leaving the situation with no clear path forward. Using the option to "email support regarding this ticket" does not provide any feedback to indicate that a message has been received by Cisco and there is no reply or follow-up after several days. Is anyone aware of a way in which an issue such as this can be addressed?
