Where Can I Find a Complete List of PAN-DB URL Filtering Categories?
1864648
Created On 09/26/18 20:46 PM - Last Modified 09/28/23 22:23 PM
Symptom
Where Can I Find a Complete List of PAN-DB URL Filtering Categories?
Environment
- Supported PAN-OS.
- Palo Alto Firewall.
- URL Categorization.
Resolution
| Category | Description | Example | ||
| 1 | Abortion | Sites that pertain to information or groups in favor of or against abortion, details regarding abortion procedures, help or support forums for or against abortion, or sites that provide information regarding the consequences/effects of pursuing (or not) an abortion. | www.prochoiceamerica.org www.prochoice.org www.prolifeaction.org | |
| 2 | Abused Drugs | Sites that promote the abuse of both legal and illegal drugs, use and sale of drug related paraphernalia, manufacturing and/or selling of drugs. | www.cannabis.com www.getkush.ca www.magicmushroom.com | |
| 3 | Adult | Sexually explicit material, media (including language), art, and/or products, online groups or forums that are sexually explicit in nature. Sites that promote adult services such as video/telephone conferencing, escort services, strip clubs, etc. Anything containing adult content (even if it's games or comics) will be categorized as adult. | www.playboyplus.com www.redtube.com | |
| 4 | Alcohol and Tobacco | Sites that pertain to the sale, manufacturing, or use of alcohol and/or tobacco products and related paraphernalia. Includes sites related to electronic cigarettes. | www.wine.com www.thompsoncigars.com www.cigarsinternational.com www.thegoodwineguru.com www.webtender.com | |
| 5 | Auctions | Sites that promote the sale of goods between individuals. | www.ebay.com www.internethorseauctions.com | |
| 6 | Business and Economy | Marketing, management, economics, and sites relating to entrepreneurship or running a business. Includes advertising and marketing firms. Should not include corporate websites as they should be categorized with their technology. Also shipping sites, such as fedex.com and ups.com. | www.bothsidesofthetable.com www.ogilvy.com www.geisheker.com www.imageworksstudio.com www.linearcreative.com www.saleforce.com www.xfinity.com | |
| 7 | Command and Control | Command-and-control URLs and domains used by malware and/or compromised systems to surreptitiously communicate with an attacker's remote server to receive malicious commands or exfiltrate data | ||
| 8 | Computer and Internet Info | General information regarding computers and the internet. Should include sites about computer science, engineering, hardware, software, security, programming, etc. Programming may have some overlap with reference, but the main category should remain computer and internet info. | www.redhat.com www.freebsd.org www.microsoft.com www.symantec.com www.oreilly.com www.alexa.com | |
| 9 | Content Delivery Networks | Sites whose primary focus is delivering content to 3rd parties such as advertisements, media, files, etc. Also includes image servers. | www.limelight.com www.cdnvideo.com www.akamai.com | |
| 10 | Copyright Infringement | Domains with illegal content, such as content that allows illegal download of software or other intellectual property, which poses a potential liability risk. This category was introduced to enable adherence to child protection laws required in the education industry as well as laws in countries that require internet providers to prevent users from sharing copyrighted material through their service. | ||
| 11 | Cryptocurrency | Websites that promote cryptocurrencies, crypto mining websites (but not embedded crypto miners), cryptocurrency exchanges and vendors, and websites that manage cryptocurrency wallets and ledgers. This category does not include traditional financial services websites that reference cryptocurrencies, websites that explain and describe how cryptocurrencies and blockchains work, or websites that contain embedded crypto currency miners (grayware). | coinbase.com binance.com bittrex.com blockchain.com crypto.com | |
| 12 | Dating | Websites offering online dating services, advice, and other personal ads | www.match.com www.eharmony.com www.okcupid.com | |
| 13 | Dynamic DNS | Hosts and domain names for systems with dynamically assigned IP addresses and which are oftentimes used to deliver malware payloads or C2 traffic. Also, dynamic DNS domains do not go through the same vetting process as domains that are registered by a reputable domain registration company, and are therefore less trustworthy. | www.no-ip.com www.dnsexit.com | |
| 14 | Educational Institutions | Official websites for schools, colleges, universities, school districts, online classes, and other academic institutions. These refer to larger, established educational institutions such as elementary schools, high schools, universities, etc. Tutoring academies can go here as well. | www.ucla.edu www.phoenix.edu www.sfusd.edu | |
| 15 | Entertainment and Arts | Sites for movies, television, radio, videos, programming guides/tools, comics, performing arts, museums, art galleries, or libraries. Includes sites for entertainment, celebrity and industry news. | www.variety.com www.tmz.com www.moma.org www.eventbrite.com | |
| 16 | Extremism | Websites promoting terrorism, racism, fascism, or other extremist views discriminating against people or groups of different ethnic backgrounds, religions or other beliefs. This category was introduced to enable adherence to child protection laws required in the education industry. In some regions, laws and regulations may prohibit allowing access to extremist sites, and allowing access may pose a liability risk. | www.kkk.com www.stormfront.org www.chimpmania.com | |
| 17 | Financial Services | Websites pertaining to personal financial information or advice, such as online banking, loans, mortgages, debt management, credit card companies, and insurance companies. Does not include sites relating to stock markets, brokerages or trading services.Includes sites for foreign currency exchange. Includes sites for foreign currency exchange. | www.chase.com www.paypal.com www.salliemae.com | |
| 18 | Gambling | Lottery or gambling websites that facilitate the exchange of real and/or virtual money. Related websites that provide information, tutorials or advice regarding gambling, including betting odds and pools. Corporate websites for hotels and casinos that do not enable gambling are categorized under Travel. | www.fulltiltpoker.com www.vegasbettinglines.com www.bet365.com | |
| 19 | Games | Sites that provide online play or download of video and/or computer games, game reviews, tips, or cheats, as well as instructional sites for non-electronic games, sale/trade of board games, or related publications/media. Includes sites that support or host online sweepstakes and/or giveaways. | www.gamespot.com www.ign.com www.1up.com www.twitch.tv | |
| 20 | Government | Official websites for local, state, and national governments, as well as related agencies, services, or laws. | www.ca.gov www.sfgov.org dmv.ca.gov www.usps.com | |
| 21 | Grayware | Web content that does not pose a direct security threat but that display other obtrusive behavior and tempt the end user to grant remote access or perform other unauthorized actions. Grayware includes illegal activities, criminal activities, rogueware, adware, and other unwanted or unsolicited applications, such as embedded crypto miners, clickjacking or hijackers that change the elements of the browser. Typosquatting domains that do not exhibit maliciousness and are not owned by the targeted domain will be categorized as grayware. | ||
| 22 | Hacking | Sites relating to the illegal or questionable access to or the use of communications equipment/software. Development and distribution of programs, how-to-advice and/or tips that may result in the compromise of networks and systems. Also includes sites that facilitate the bypass of licensing and digital rights systems. | www.hackspc.com www.hackthissite.org | |
| 23 | Health and Medicine | Sites containing information regarding general health information, issues, and traditional and non-traditional tips, remedies, and treatments. Also includes sites for various medical specialties, practices and facilities (such as gyms and fitness clubs) as well as professionals. Sites relating to medical insurance and cosmetic surgery are also included. | www.kaiserpermanente.org www.webmd.com www.24hourfitness.com | |
| 24 | Home and Garden | Information, products, and services regarding home repair and maintenance, architecture, design, construction, décor, and gardening. | www.bhg.com www.homedepot.com www.gardenweb.com | |
| 25 | Hunting and Fishing | Hunting and fishing tips, instructions, sale of related equipment and paraphernalia. | www.wildlifelicense.com www.outdoorlife.com | |
| 26 | Insufficient Content | Websites and services that present test pages, no content, provide API access not intended for end-user display or require authentication without displaying any other content suggesting a different categorization. Should not include websites providing remote access, such as web based VPN solutions, web based email services or identified credential phishing pages. | ||
| 27 | Internet Communications and Telephony | Sites that support or provide services for video chatting, instant messaging, or telephony capabilities. | www.skype.com www.slack.com www.gotomeeting.com | |
| 28 | Internet Portals | Sites that serve as a starting point for users, usually by aggregating a broad set of content and topics. | www.yahoo.com www.qq.com www.msn.com | |
| 29 | Job Search | Sites that provide job listings and employer reviews, interview advice and tips, or related services for both employers and prospective candidates. | www.monster.com www.indeed.com www.simplyhired.com | |
| 30 | Legal | Information, analysis or advice regarding the law, legal services, legal firms, or other legal related issues. | www.probono.net www.findlaw.com | |
| 31 | Malware | Sites known to host malware or used for command and control (C2) traffic. May also exhibit Exploit Kits. | ||
| 32 | Military | Information or commentary regarding military branches, recruitment, current or past operations, or any related paraphernalia. | www.goarmy.com www.pentagon.mil | |
| 33 | Motor Vehicles | Information relating to reviews, sales and trading, modifications, parts, and other related discussions for automobiles, motorcycles, boats, trucks and RVs. | www.edmunds.com www.carfax.com www.audi.com www.discounttire.com | |
| 34 | Music | Music sales, distribution, or information. Includes websites for music artists, groups, labels, events, lyrics, and other information regarding the music business. Does not include streaming music. | www.u2.com www.itunes.com www.azlyrics.com | |
| 35 | Newly Registered Domain* | Newly registered domains are often generated purposely or by domain generation algorithms and used for malicious activity. | ||
| 36 | News | Online publications, newswire services, and other websites that aggregate current events, weather, or other contemporary issues. Includes newspapers, radio stations, magazines, and podcasts. | www.reuters.com www.abcnews.com www.weather.com | |
| 37 | Not-resolved | Indicates that the website was not found in the local URL filtering database and the firewall was unable to connect to the cloud database to check the category. When a URL category lookup is performed, the firewall first checks the dataplane cache for the URL, if no match is found, it will then check the management plane cache, and if no match is found there, it queries the URL database in the cloud. When deciding on what action to take for traffic that is categorized as not-resolved, be aware that setting the action to block may be very disruptive to users. | ||
| 38 | Nudity | Sites that contain nude or seminude depictions of the human body, regardless of context or intent, such as artwork. Includes nudist or naturist sites containing images of participants. | www.nudistbeaches.nl | |
| 39 | Online Storage and Backup | Websites that provide online storage of files for free and as a service. | www.dropbox.com www.evernote.com www.slideshare.net | |
| 40 | Parked | URLs which host limited content or click-through ads which may generate revenue for the host entity but generally do not contain content that is useful to the end user. | ||
| 41 | Peer-to-Peer | Sites that provide access to or clients for peer-to-peer sharing of torrents, download programs, media files, or other software applications. This is primarily for those sites that provide bittorrent download capabilities. Does not include shareware or freeware sites. | www.thepiratebay.org www.emule-project.net www.bitcomet.com | |
| 42 | Personal Sites and Blogs | Personal websites and blogs by individuals or groups. Should try to first categorize based on content. For example, if someone has a blog just about cars, then the site should be categorized under "motor vehicles". However, if the site is a pure blog, then it should remain under "personal sites and blogs". | www.blogspot.com www.wordpress.com www.blogger.com | |
| 43 | Philosophy and Political Advocacy | Sites containing information, viewpoints or campaigns regarding philosophical or political views. | www.bradyunited.org www.ontheissues.org www.the-philosophy.com | |
| 44 | Phishing | Web content that covertly attempts to fool the user in order to harvest information, including login credentials, credit card information – voluntarily or involuntarily, account numbers, PINs, and any information considered to be personally identifiable information (PII) from victims via social engineering techniques. Technical support scams and scareware is also included as phishing. | ||
| 45 | Private IP Addresses | This category includes IP addresses defined in RFC 1918, 'Address Allocation for Private Intranets? It also includes domains not registered with the public DNS system ( *.local and *.onion). | 10.0.0.0 - 10.255.255.255 (10/8 prefix) 172.16.0.0 - 172.31.255.255 (172.16/12 prefix) 192.168.0.0 - 192.168.255.255 (192.168/16 prefix) 169.254.0.0 - 169.254.255.255 (169.254/16 prefix) | |
| 46 | Proxy Avoidance and Anonymizers | URLs and services often used to bypass content filtering products. | www.proxify.com www.hide.me www.anonym.to | |
| 47 | Questionable | Websites containing tasteless humor, offensive content targeting specific demographics of individuals or groups of people. | www.acidcow.com www.9gag.com | |
| 48 | Real Estate | Information on property rentals, sales and related tips or information. Includes sites for real estate agents, firms, rental services, listings (and aggregates), and property improvement. | www.realtor.com www.redfin.com www.zillow.com | |
| 49 | Recreation and Hobbies | Information, forums, associations, groups, and publications on recreations and hobbies. | www.cross-stitching.com www.modelaircraft.org | |
| 50 | Reference and Research | Personal, professional, or academic reference portals, materials, or services. Includes online dictionaries, maps, almanacs, census information, libraries, genealogy and scientific information. | www.wikipedia.org www.reference.com www.m-w.com | |
| 51 | Religion | Information regarding various religions, related activities or events. Includes websites for religious organizations, officials and places of worship.Includes sites for fortune telling. | www.vatican.va www.sjkoreancatholic.org www.biblesociety.ca | |
| 52 | Search Engines | Sites that provide a search interface using keywords, phrases, or other parameters that may return information, websites, images or files as results. | www.google.com www.baidu.com www.bing.com | |
| 53 | Sex Education | Information on reproduction, sexual development, safe sex practices, sexually transmitted diseases, birth control, tips for better sex, as well as any related products or related paraphernalia. Includes websites for related groups, forums or organizations. | www.plannedparenthood.org www.sexetc.org | |
| 54 | Shareware and Freeware | Sites that provide access to software, screensavers, icons, wallpapers, utilities, ringtones, themes or widgets for free and/or donations. Also includes open source projects. | www.download.com www.sourceforge.net www.github.com | |
| 55 | Shopping | Sites that facilitate the purchase of goods and services. Includes online merchants, websites for department stores, retail stores, catalogs, as well as sites that aggregate and monitor prices. Sites listed here should be online merchants that sell a variety of items (or whose main purpose is online sales). A webpage for a cosmetics company that also happens to allow online purchasing should be categorized with cosmetics and not shopping. | www.amazon.com www.pricegrabber.com www.lightningdrops.com www.aliexpress.com | |
| 56 | Social Networking | User communities and sites where users interact with each other, post messages, pictures, or otherwise communicate with groups of people. Does not include blogs or personal sites. | www.facebook.com www.twitter.com www.linkedin.com | |
| 57 | Society | Topics relating to the general population, issues that impact a large variety of people, such as fashion, beauty, philanthropic groups, societies, or children. Also includes restaurant websites.Includes websites designed for children as well as restaurants. | www.redcross.org www.harpersbazaar.com www.foodnetwork.com www.savethechildren.org | |
| 58 | Sports | Information about sporting events, athletes, coaches, officials, teams or organizations, sports scores, schedules and related news, and any related paraphernalia. Includes websites regarding fantasy sports and other virtual sports leagues. | www.espn.com www.nba.com sports.yahoo.com | |
| 59 | Stock Advice and Tools | Information regarding the stock market, trading of stocks or options, portfolio management, investment strategies, quotes, or related news. | www.thestreet.com www.bloomberg.com www.investopedia.com | |
| 60 | Streaming Media | Sites that stream audio or video content for free and/or purchase.Includes online radio stations and other streaming music services. | www.hulu.com www.youtube.com www.pandora.com www.spotify.com | |
| 61 | Swimsuits and Intimate Apparel | Sites that include information or images concerning swimsuits, intimate apparel or other suggestive clothing. | www.victoriassecret.com www.brazilianswimwear.com | |
| 62 | Training and Tools | Sites that provide online education and training and related materials.Can include driving/traffic schools, workplace training, etc. | www.trafficschoolonline.com www.moodle.com www.redvector.com www.quizlet.com | |
| 63 | Translation | Sites that provide translation services, including both user input and URL translations. These sites can also allow users to circumvent filtering as the target page's content is presented within the context of the translator's URL. | translate.google.com bing.com/translator babelfish.com | |
| 64 | Travel | Information regarding travel tips, deals, pricing information, destination information, tourism, and related services. Includes websites for hotels, local attractions, casinos, airlines, cruise lines, travel agencies, vehicle rentals and sites that provide booking tools such as price monitors.Includes websites for local points of interest/tourist attractions such as the Eiffel Tower, the Grand Canyon, etc. | www.kayak.com www.farecompare.com www.tripadvisor.com www.jetblue.com | |
| 65 | Unknown | Sites that have not yet been identified by PAN-DB. If availability is critical to your business and you must allow the traffic, alert on unknown sites, apply the best practice Security profiles to the traffic, and investigate the alerts. | ||
| 66 | Weapons | Sales, reviews, descriptions of or instructions regarding weapons and their use. | www.israeli-weapons.com www.grabagun.com | |
| 67 | Web Advertisements | Advertisements, media, content, and banners. | www.doubleclick.com www.popads.net | |
| 68 | Web Hosting | Free or paid for hosting services for web pages, including information regarding web development, publication, promotion, and other methods to increase traffic. | www.godaddy.com www.fatcow.com | |
| 69 | Web-based Email | Any website that provides access to an email inbox and the ability to send and receive emails. | 126.com outlook.com gmail.com | |
| 70 | Real-Time-Detection | Detects New and Unknown Malicious Web-Based Attacks in real-time. This is a feature of Advanced URL Filtering. | ||
| 71 |
Ransomware* *This category will be visible on all PAN-OS releases but only supported on PANOS versions 9.1 onwards. | Websites known to host ransomware or malicious traffic involved in conducting ransomware campaigns that generally threaten to publish private data or keep access to specific data or systems blocked, usually by encrypting it, until the demanded ransom is paid | ||
| 72 |
Encrypted-DNS* * The Encrypted-DNS category functionality will only be supported on PAN-OS versions 9.1 onwards. For PAN-OS version 9.0 and below, Encrypted-DNS detections will be covered under the “Computer-and-internet-info” category. | Hostnames known to host DNS over HTTPS (DoH) resolver services. DoH encrypts DNS requests and responses to ensure privacy and security of end users DNS traffic |
https://mozilla.cloudflare-dns.com/dns-query https://dns.google/dns-query | |
| 73 | Artificial Intelligence | Websites that use machine learning and deep learning models, including large language models, to provide services that would have typically required human intelligence. The services provided include but are not limited to chatbot, productivity, summarizer, transcriber, no-code, and audio/video editing-related services. Emphasis is given to websites hosting the actual AI service, not informational AI content. |
https://chat.openai.com/ | |
| 74 |
Scanning Activity* The Scanning Activity category will be visible across all supported PAN-OS versions. However, it is functional only for firewalls running PAN-OS 9.1 and later versions and requires an Advanced URL filtering license | URLs associated with malicious campaigns conducted by adversaries. Such activities sometimes serve as indicators of compromised user machines that are probing for existing vulnerabilities. These actions are typically part of reconnaissance activities carried out by adversaries. | ||
Security-Focused URL Categories:
| Category | Description | |
|---|---|---|
| High Risk* | Sites that were previously confirmed to be malicious but have displayed benign activity for at least 30 days. Sites hosted on bulletproof ISPs or using an IP from an ASN that has known malicious content. Sites sharing a domain with a known malicious site. All sites in the “Unknown” category will be high risk. | |
| Medium Risk* | Sites confirmed to be malicious but have displayed benign activity for at least 60 days. All sites in the “Online Storage and Backup” category will be a medium risk by default. | |
| Low Risk* | Any site that is not High Risk or Medium Risk. This includes sites that were previously confirmed as malicious but have displayed benign activity for at least 90 days. | |
| Newly-Registered Domains* |
Identifies sites that have been registered within the last 32 days. New domains are frequently used as tools in malicious campaigns. Newly-registered domains are often generated purposefully or by domain generation algorithms and used for malicious activity. It is a best practice to block this URL category. | |
*This category requires PAN-OS 9.0 and higher. Please see Multi-Category URL Filtering in URL Filtering Use Cases for more information.
PAN-OS version 8.0 and above has a way of blocking Corporate Credential Submissions. Refer to Prevent Credential Phishing for details.
Additional Information
Please click here for Palo Alto Networks URL Test Pages.
NOTE:
- For more information on "Real-Time-Detection.", please click here.
- Ransomware is an Advanced URL Filtering category.