URL Scan Flow

After a URL is received from an input source, it goes through the following steps before a verdict is reached. If a verdict can be reached at any step, the scan stops.

1. Static Scan.

   In this step, the URL is checked against the user uploaded allowlist/blocklist (White/Black list) and the Overridden Verdicts list.

2. Sandboxing Scan.

   If WEBLink is associated with a VM type as defined in the Scan Profile page > VM Association tab, the URL is scanned inside a clone of that VM type. If the URL type is enabled with the sandboxing pre-filtering command, only URLs whose webfiltering category is UNRATED is scanned inside a VM.

   For more information, see the the sandboxing-prefiltering command in the FortiSandbox CLI Guide.

In the Static Scan step, URLs are checked against the user uploaded allow (white) list and block (black) list in this order and rated as Clean or Malicious: Domain black list > URL REGEX black list > URL black list > Domain white list > URL REGEX white list > URL white list. For example, if users enter *.microsoft.com in the domain allowlist and http://www.microsoft.com/.*abc/bad.html in the URL blocklist, URL http://www.microsoft.com/1abc/bad.html is rated as Malicious.