Ex-PANW here. It's almost certainly the firewall's URL Filtering feature (aka PAN-DB).<p>When someone makes an HTTP request, the firewall takes the host and path from the request and looks them up first in a local cache on the data plane, then in the cloud. (As you can imagine, bypassing the entire feature is therefore trivial for malware. You just open a connection to an arbitrary IP address and put, say, google.com in the host header. As far as the firewall can tell, you are in fact talking to google.com.)<p>When the URL isn't already known to the cloud, or hasn't been visited more recently than its TTL, it goes into a queue to be refreshed by the crawler, which will make its way there shortly thereafter to classify the page.<p>Palo Alto has other URL scanners, but none that would reliably visit the page <i>after</i> the user. URLs carved out of SMTP traffic, for example, would mostly be visited before the real user, not after.