I found a few leads googling around Palo Alto Networks docs website: - "Advanced URL Filtering" seems to have a feature where web content is either can be eval

I found a few leads googling around Palo Alto Networks docs website: - "Advanced URL Filtering" seems to have a feature where web content is either can be evaluated "inline" or "web payload data is also submitted to Advanced URL Filtering in the cloud" [1]. - If a URL is considered 2 spooky to load on the user's endpoint, it can instead be loaded via "Remote Browser Isolation" in a remote-desktop-like session, on demand, for that single page only [2]. I think either (or both) could explain the signals you're detecting. [1]: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-basics/how-url-filtering-works#:~:text=If%20the%20URL%20displays%20risky%20or%20malicious%20characteristics%2C%20the%20web%20payload%20data%20is%20also%20submitted%20to%20Advanced%20URL%20Filtering%20in%20the%20cloud%20for%20real%2Dtime%20analysis%20and%20generates%20additional%20analysis%20data https://docs.paloaltonetworks.com/advanced-url-filtering/adm.... [2]: https://docs.paloaltonetworks.com/advanced-url-filtering/administration/url-filtering-features/integrate-with-a-remote-browser-isolation-rbi-provider https://docs.paloaltonetworks.com/advanced-url-filtering/adm...