Traffic Logs have an http_category without a destination hostname or URL

[thenetworksfine]

I am seeing a pattern where I observe an http_category in my pan:traffic logs where log_subtype=end but there is no dest_hostname or URL. Is it possible that Palo is classifying based on IP address? We are not decrypting SSL traffic in this instance and I see no other corresponding logs for the same traffic (pan:threat).

[reaper]

could you provide a screenshot?

sessions toward an IP address that have url filtering enabled will also be checked against the url database