FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 216802



This article describes how the web URL is blocked falsely positively by FortiGate Antivirus.




FortiOS 5.4 - 6.2.




The web browser shows the message that FortiGate is not permitted to open the page because it is infected with the virus.




Another way to get more information on the blocking is to check the ‘AV logs’ under ‘Logs & Report’.


For example, the below log entry on FortiGate Antivirus blocks the URL < >.


date=2022-06-24 time=15:30:39 eventtime=1656099039399965078 tz="-0400" logid="0211008192" type="utm" subtype="virus" eventtype="infected" level="warning" vd="root" policyid=2 poluuid="0017c7ea-f3ef-51ec-3c82-03c70b9d5e13" policytype="policy" msg="File is infected." action="blocked" service="HTTP" sessionid=1096562 srcip= dstip= srcport=50090 dstport=80 srccountry="Reserved" dstcountry="United States" srcintf="port3" srcintfrole="undefined" dstintf="port2" dstintfrole="undefined" srcuuid="e158a4da-f0b2-51ec-4cbe-d5f15428a24f" dstuuid="e158a4da-f0b2-51ec-4cbe-d5f15428a24f" proto=6 direction="incoming" filename="submit-an-event.html" quarskip="File-was-not-quarantined" virus="HTML/Agent.CKH!tr" viruscat="Virus" ref="**bleep**ent.CKH%21tr" virusid=10088653 url="" profile="default" agent="Chrome/" analyticssubmit="false" crscore=50 craction=2 crlevel="critical"


This website was identified as a false positive.

To identify whether a URL is infected by checking the URL in an external website-checker, for example:
It is possible to see there that this website is now shown as 'clean'.


One reason could be FortiGate’s web cache, because the cache may have saved the data of the previous infected version of the web page.

To clear the web cache, enter:


diagnose test application urlfilter 2


Or reboot the FortiGate (exec reboot).

Another reason is that the website checker is only displaying the homepage, and not attempting to access any links or download any files needed throughout navigation. In that case, the file may indeed be infected. The FortiGate logs will say exactly which file triggered the alert.

It is also possible to report a false alarm or categorization with FortiGuard: 

FortiGuard - Contact us