FortiGuard reports FakeCaptcha on our site, but repeated reviews won’t provide a sample — how do we escalate?

Hey everyone, hoping someone can point me in the right direction because I’m going in circles with the FortiGuard review process.

I manage an IIS server hosting a Symfony/PHP application. FortiGuard changed our hostname’s category from Business to Malicious Websites on 20 August, and users behind Fortinet filtering are being blocked.

I’ve submitted several review requests. The responses keep repeating an HTML/FakeCaptcha detection. One analyst said there was “malicious JavaScript at line 10.”

I’m taking the detection seriously, but we haven’t been able to reproduce it. So far:

• We inspected the application source at the production build’s commit and the deployed public files, including compiled JavaScript. No fake CAPTCHA content found.
• We captured the public HTTPS login response. Line 10 is a favicon link, not JavaScript.
• The hostname is rated malicious; its IP is separately “Not Rated.”

We’ve asked for the exact affected URL, detected code/sample, timestamp, redirect chain, scanner destination IP, and whether the finding is fresh or historical. We also explicitly requested escalation to a technical analyst.

The latest response just repeats the detection name again, without any of those details.

At this point it feels like I’m talking to a bot stuck on the same one-line response. I ask for the flagged code, the URL, or details to reproduce it, and get “the domain is infected” back. Even asking for escalation gets the same answer.

If there’s malicious code, I want to find it and fix it. But “line 10” doesn’t help when the page we receive has a favicon link there, and asking for their copy of that page gets us nowhere. Meanwhile, users are still blocked.

Has anyone managed to get past this loop and speak to someone at FortiGuard who can provide actual detection details? What escalation route worked for you?