https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53070#M2084 The site that you're looking at is only showing you the categorization according to URL Filtering, not according to the Threat Prevention blades.<BR />When I tried accessing that site earlier from behind my own Check Point gateway, I did not get blocked by Anti-Bot.<BR />Likewise, nothing responds at that IP currently. Thu, 09 May 2019 21:54:24 GMT PhoneBoy 2019-05-09T21:54:24Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53056#M2079 <P>Greetings checkmates. I have following question: firewall notified me about high risk activity of BOT on LAN, by detecting DNS query to resolve site&nbsp;<STRONG>nativesubscribe.pro</STRONG>,&nbsp; however checkpoint's&nbsp; url categorization indicate that site mentioned before&nbsp; is belong to <STRONG>general</STRONG> category uniquely.</P><P>Why this difference?</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="Security Alert--nativesubscribe.pro.JPG" style="width: 481px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/1129i52D739DC52583698/image-size/large?v=v2&amp;px=999" role="button" title="Security Alert--nativesubscribe.pro.JPG" alt="Security Alert--nativesubscribe.pro.JPG" /></span></P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P>&nbsp;</P><P><span class="lia-inline-image-display-wrapper lia-image-align-left" image-alt="Security Alert--nativesubscribe.pro2.JPG" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/1128i40516A74E9265C05/image-size/large?v=v2&amp;px=999" role="button" title="Security Alert--nativesubscribe.pro2.JPG" alt="Security Alert--nativesubscribe.pro2.JPG" /></span></P> Thu, 09 May 2019 19:04:18 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53056#M2079 LuisSP 2019-05-09T19:04:18Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53070#M2084 The site that you're looking at is only showing you the categorization according to URL Filtering, not according to the Threat Prevention blades.<BR />When I tried accessing that site earlier from behind my own Check Point gateway, I did not get blocked by Anti-Bot.<BR />Likewise, nothing responds at that IP currently. Thu, 09 May 2019 21:54:24 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53070#M2084 PhoneBoy 2019-05-09T21:54:24Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53073#M2085 <P>This actually gives me an idea: can we get a tool built into SmartConsole that will allow us to either paste the URLs, or invoke their access directly from the logs and run them through Check Point's hosted services to determine if any of the blades block it outside our environments. Brief report describing reason for blocking access will be helpful.</P> <P>This should speed-up troubleshooting and provide sanity checks.</P> Thu, 09 May 2019 22:36:47 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53073#M2085 Vladimir 2019-05-09T22:36:47Z https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53078#M2086 That's what I use my own firewalls for <span class="lia-unicode-emoji" title=":beaming_face_with_smiling_eyes:">😁</span><BR />But I see where that could be valuable. Thu, 09 May 2019 23:44:38 GMT https://community.checkpoint.com/t5/Spark-Firewall-SMB/Is-this-site-at-wrong-categorization/m-p/53078#M2086 PhoneBoy 2019-05-09T23:44:38Z