Skip to main content
kjiye
Staff & Editor
kjiye
Staff & Editor
March 29, 2023

Troubleshooting Tip: 'Newly Registered Domain' and 'Newly Observed Domain' and Webfilter category processing logic

  • March 29, 2023
  • 1 reply
  • 49143 views
Description This article explains how URLs in the 'Newly Registered Domain' and 'Newly Observed Domain' classifications are re-categorized.
Scope FortiGate 5.6 or above.
Solution

A URL is categorized as 'Newly Registered Domain' (NRD) in the FortiGuard database if the domain was registered in the previous 10 days. The 10 days refers to the age of the domain from when it was first registered. These URLs will remain in this category during the 10 days until the NRD rating expires and then they will change to 'Not Rated'.

 

A URL is detected as a 'Newly Observed Domain' (NOD) if the domain name does not exist in the database and the URL is observed for the first time by the FortiGuard Distribution Servers(FDN) or FortiGuard server. The URL will then remain in this category for 30 minutes during which it is scanned for malicious content. If there is no malicious content found, the category for the URL changes to 'Not Rated'.

These 'Not Rated' domains will then be queued for review based on the visit counts. The duration depends on how popular the 'Unrated' websites are and how long the 'Unrated' queue is.

However, after some time, it is also possible to encounter the same domain as NOD again for these reasons:

 

  • The FDN cache expires and the URL gets removed from the cache; the NOD rating is returned, then 'Unrated' and back to NOD again. The NOD cache on the FDN servers has a size limit, so the domain would be added/removed from the cache (based on visit count, time etc).
  • Because of the rare visits, it is possible to hit a different FDN server, and that server seeing the URL for the first time returns the NOD rating.

the FDN or FortiGuard url entry Cache can be checked by the below command

 

diag webfilter fortiguard cache ttl


As for URL re-categorization made via the FortiGuard Web Filter Rating Submission, the response time may vary depending on the number of submissions in the queue/priority.

 

Related documents:

Web Filter Classification Rating Request   

Troubleshooting Tip: Verify the webfilter cache content

Technical Tip: CLI commands to verify status of the FortiGuard service

1 reply

Fosup
New Member
June 10, 2026

Hi Kjiye,

Thanks for the detailed explanation regarding NRD and NOD categories in your previous post. I have a follow-up question concerning the documentation:

Where exactly can I find official documentation stating that Newly Registered Domains remain in the 'NRD' category for 10 days? Do you have a specific link to a Fortinet Knowledge Base article or support document?

We have observed some inconsistencies in practice:

  • We recorded a domain being registered.
  • On the same day, its category changed from NRD to "Information Technology".

This suggests that the 10-day period might not be strictly enforced in all cases. Could there be other factors influencing this, such as cache expiration, high visit counts triggering faster review, or regional server differences?

Would appreciate any insights or references.

    Terms & ConditionsAccessibility statement
    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!