This is a false positive. Palo Alto support provided the following: I understand you are looking for a reason why this URL was marked as malware and why it flipped back. This domain is not malware, it was accidentally released last night, and as soon as we realized it was flip to shareware and disabled it. We are in the process of taking steps, such as adding this and some subdomains under lencr.org found in our database in a restrictive white list, domains under that list can't be released to malware. That step will avoid the similar FP case is caused in future.
... View more