Anyone else seeing ublockorigin.pages.dev and malware-filter.pages.dev being blocked in the phishing category?

sounetworksupport — Fri, 02 Sep 2022 15:26:56 GMT

This morning I noticed some hosts on our network were blocked from visiting ublockorigin.pages.dev and malware-filter.pages.dev because the URL filter categorized those pages as phishing. These URLs appear to be associated with the uBlock Origin adblocker extension. Does anyone know why these pages are categorized as phishing now by Palo Alto?

Re: Anyone else seeing ublockorigin.pages.dev and malware-filter.pages.dev being blocked in the phishing category?

nikoolayy1 — Thu, 08 Sep 2022 10:53:04 GMT

Check your inline ML engine as this could be because of it : https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/url-filtering/configure-url-filtering-inline-ml

To check the cloud URL database go to https://urlfiltering.paloaltonetworks.com/ and if needed "Request a Change" if you think it is a false positive.

Also look at this link to get the idea about ML-inline:

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000oM37CAE&lang=en_US%E2%80%A9

Edit:

I forgot to add that you can also create a custom category for the URL that will overide the default one:

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/url-filtering/custom-url-categories

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClH5CAK

topic Re: Anyone else seeing ublockorigin.pages.dev and malware-filter.pages.dev being blocked in the phishing category? in Next-Generation Firewall Discussions

Anyone else seeing ublockorigin.pages.dev and malware-filter.pages.dev being blocked in the phishing category?

Re: Anyone else seeing ublockorigin.pages.dev and malware-filter.pages.dev being blocked in the phishing category?