How to request review of residual High-Risk rating when category dispute has been resolved?

[paul.barrett]

I am the volunteer webmaster for Berkshire Family History Society, a UK registered charity. I am seeking guidance on the correct process for requesting review of a Risk Level rating when the URL category dispute has already been resolved.

The history is straightforward. On 11 May 2026 our domain berksfhs.org was classified by PAN-DB as Malware. The classification was incorrect, resulting from a December 2025 Netcraft alert which was subsequently withdrawn by Netcraft themselves but which appears to have propagated to PAN-DB's database. I submitted a reclassification request through urlfiltering.paloaltonetworks.com and the category was promptly corrected to Reference-and-Research (now confirmed at DB version 20260516.20200), for which I am grateful.

The residual issue is that the public lookup tool still shows Risk Level: High-Risk for berksfhs.org. The description text for this rating refers to bulletproof ISPs, ASN reputation, or domain-association with known malicious sites. The most likely contributor in our case was our development subdomain dev.berksfhs.org, which was a publicly-accessible content clone of the live site. I have since restricted dev.berksfhs.org to an IP allow-list and it now returns a benign 403 page to all other visitors including reputation classifiers.

I submitted a follow-up via the urlfiltering portal explaining this and requesting Risk Level re-evaluation, but the form appears to be category-only. My follow-up was processed as a category change request (kept the existing category, did not address the Risk Level). The reply directs me to Palo Alto Networks support for follow-up.

The substantive question: what is the appropriate route for requesting Risk Level review when the urlfiltering portal cannot address it? Our domain is currently rated clean by Google Safe Browsing, VirusTotal, BrightCloud (Trustworthy 81/100), Symantec, Trellix, IBM X-Force and Kaspersky. PAN-DB is the only outlier still rating us as elevated risk, and downstream consumers of the PAN-DB feed are presumably acting on the High-Risk rating in their filtering decisions, which is causing real-world impact on members of our charity attempting to reach our website from corporate or institutional networks.

Any guidance on the correct channel for this would be much appreciated.

Paul Barrett Volunteer Webmaster Berkshire Family History Society

[kiwi]

Hi @paul.barrett ,

You have raised a valid concern regarding the management of URL categories, particularly for domains not owned by Palo Alto Networks customers, and the impact of dynamically assigned risk categories on filtering policies.

If you believe a domain's content category (e.g., a business site being miscategorized as "gambling") is incorrect, you or anyone can submit a recategorization request. This can be done via the Test A Site tool (urlfiltering.paloaltonetworks.com) which you have already done correctly or you can request a change directly from the firewall's URL filtering logs.

However, you can’t submit a change request for risk categories due to the dynamic nature of the categories.

Sites remain in this category for at least 30 days.

Sources and additional info:

• https://docs.paloaltonetworks.com/advanced-url-filtering/administration/monitoring/request-to-change...
• https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/url-cat...

Best,