When does a URL get categorized as 'newly-registered-domain'?
Question
When does a URL get categorized as 'newly-registered-domain'?
Environment
- Palo Alto Firewall.
- Any PAN-OS.
- PAN DB URL Filtering.
Answer
URLs are categorized as a 'newly-registered-domain' when the domain has been registered (Passive DNS is observed) within the last 32 days. We also consider re-registration as newly registered because it could come with ownership change.
After this period, Palo Alto Networks will crawl the URL to determine if it needs to be re-categorized. If this is unsuccessful, the category will be Insufficient-Content, Newly-Registered-Domain. The crawler then tries again at 3 day, 7 day, 2 week, and 30 day markers. By the last day if the crawler cannot determine the content, the URL will be categorized as "Insufficient-Content".
As a temporal workaround, please use a custom URL category if needed.
https://docs.paloaltonetworks.com/advanced-url-filtering/administration/configuring-url-filtering/url-category-exceptions/create-a-custom-url-category