topic How do I get a website's risk level lowered, since we know it is safe? in General Topics

How do I get a website's risk level lowered, since we know it is safe?

lloving — Wed, 14 Aug 2024 15:20:37 GMT

Earlier this week, I submitted a website that was blocked because it was categorized as malware incorrectly. This was corrected very quickly. Now that same website is blocked because it is listed as "high risk". We know that it is not. When I tried to use the same method to change the category, the message tells me I need to contact support to fix this. The problem is that if I use the customer support portal, I cannot accurately report the problem, and am required to fill out information that does not apply. I tried to call, and the call tree refuses to connect me to a live person, because I do not have a support ticket, and disconnects the call.

How do I get a website changed from "high risk" to a more acceptable level?

We are using a Palo PA-850

Thank you

Re: How do I get a website's risk level lowered, since we know it is safe?

BPry — Wed, 14 Aug 2024 15:26:15 GMT

@lloving,

If it's something that you've deemed same then override it so your users can access that site. This category can't be modified via request and isn't something that is recommended to be blocked (however a lot of people do). The criteria for high-risk is the following:

Sites previously confirmed to be malware, phishing, or C2 sites that have displayed only benign activity for at least 30 days.
Unknown domains are classified as high-risk until PAN-DB completes site analysis and categorization.
Sites that are associated with confirmed malicious activity. For example, a page might be high-risk if there are malicious hosts on the same domain, even if the page itself does not contain malicious content.
Bulletproof ISP-hosted sites.
Sites hosted on IPs from ASNs that are known to allow malicious content.

It's possible that the activity that PAN recorded simply cleared since your manual review, but they still have malicious activity recorded. Contacting support wouldn't have them clear the high-risk categorization, it would simply lead to them walking you through making an exception.

Re: How do I get a website's risk level lowered, since we know it is safe?

lloving — Wed, 14 Aug 2024 15:31:06 GMT

is there any way to know what the trigger was? the website is https://mthf.org/resource/2024-medicaid-in-montana/

Re: How do I get a website's risk level lowered, since we know it is safe?

Goofball — Thu, 15 Aug 2024 04:09:44 GMT

Hi Lloving,

I found your post because my website was flagged as malicious, similarly to the one you're having trouble accessing. In another post I found this link for the owner of the website to use to request a change; it's what I need to solve my issue, and maybe the owner of MTHF can submit their website for reevaluation as well.
https://urlfiltering.paloaltonetworks.com/

Re: How do I get a website's risk level lowered, since we know it is safe?

lloving — Thu, 15 Aug 2024 13:22:36 GMT

Thank you @Goofball! I will pass that on, to see if they will do it.