Because it will not be downloaded, the connection is aborted. You don’t listen really. If you download huge infected archives regularly ::slight_smile: then disable scanning those archive types in webshield. Then they will eventually end up in the chest, once the filesystem shield hits them. What you suggest is very dangerous, the connection simply must be aborted as fast as possible to prevent drive-by infections.