AWS sites categorized as "unknown" in URL filtering logs and blocked

[K.Graves221717]

Good morning,

I'm having an issue where AWS sites like *.amazonaws.com and *.awsglobalaccelerator.com are getting regularly categorized as "unknown" and then blocked per our url filtering profiles.

I have confirmed that the connection to the url cloud looks good:

)> show url-cloud status

PAN-DB URL Filtering
License : valid
libcurl resolver : threaded
Current cloud server : serverlist3.urlcloud.paloaltonetworks.com
Cloud connection : connected
Cloud mode : public
URL database version - device : 20251017.20228
URL database version - cloud : 20251017.20228 ( last update time 2025/10/17 10:08:00 )
URL database status : good
URL protocol version - device : pan/2.0.0
URL protocol version - cloud : pan/2.0.0
Protocol compatibility status : compatible

I have also tried adding these domains to the exclusion list under inline categorization in the url filtering profile and I've tried clearing the url cache.  These sites still get identified as "unknown" and I've confirmed that they are benign sites.  Users report this issue is sporadic.  Sometimes even just refreshing the page will allow their traffic to pass.

I don't want aws traffic to simply bypass URL filtering altogether, but I need these sites to not be intermittently blocked.

Anyone run into this?  Thanks!

[nikoolayy1]

Why don't just add them in your own custom category that is allowed?

Also is inline ML involved in this as this is advanced URL filtering forum where the NGFW can use prebuild ML/AI models to categorize unknown sites ?

URL Filtering Inline ML