> Source: [sk180575](https://support.checkpoint.com/results/sk/sk180575)

# sk180575 - DNS trap is triggered for benign website

| Property | Value |
|----------|-------|
| Solution ID | sk180575 |
| Date Created | 2023-02-13 |
| Last Modified | 2023-04-17 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * The anti-virus blade triggers a DNS trap for a benign URL.
* After uses clear the Anti-Virus and Anti-Bot kernel cache (see [sk105179](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk105179)), the problem is not resolved.
* On the CLI of the Security Gateway, after users run kernel debug with flags: `
  `  
  `fw ctl debug -m MALWARE + all`  
  ` 
  `   
  output shows the URL was matched to an indicator:  
  `
  `  
  `@;100226548;11Jan2023 6:12:36.663361;[cpu_10];[fw4_10];1:{policy} : malware_res_rep_pm_match_cb: indicator_match 1;`  
  `
  `  
  `@;100226548;11Jan2023 6:12:36.663362;[cpu_2];[fw4_11];1:{policy} : malware_res_rep_send_log: pcap_enable=1;`  
  `
  `  
  `@;100226548;11Jan2023 6:12:36.663363;[cpu_10];[fw4_10];1:{policy} : malware_res_rep_pm_match_cb: category 0 action REDIRECT, rep_id 17767056481673519021;`  
  `
  `  
  `@;100226548;11Jan2023 6:12:36.663365;[cpu_2];[fw4_11];1:{policy} : malware_res_rep_send_log: max_pcap_num=3 suppressed_cnt=2;`  
  `
  `  
  `@;100226548;11Jan2023 6:12:36.663367;[cpu_10];[fw4_10];1:{policy} : malware_res_rep_classify_ex: indicator_match 1, action REDIRECT;`  
  `
  `

  <br />

## Cause

The URL is matched by a configured Threat Indicator.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content