About dlonek

This is a false positive.  Palo Alto support provided the following: I understand you are looking for a reason why this URL was marked as malware and why it flipped back. This domain is not malware, it was accidentally released last night, and as soon as we realized it was flip to shareware and disabled it. We are in the process of taking steps, such as adding this and some subdomains under lencr.org found in our database in a restrictive white list, domains under that list can't be released to malware. That step will avoid the similar FP case is caused in future. ... View more

Certainly possible.  I am concerned if your theory is true.  That would indicate several endpoints have some undetected malware on them.  We fortunately block traffic to this specific endpoint, although only when categorized as malware.  Otherwise I see traffic to this endpoint going back weeks.  We are opening a case with Palo TAC support to better understand what is going on.  If we identify root cause I will provide an update here.  ... View more

We didn't see thousands but this happened on 6/11 (matching the time frame from the OP), and then last night between between 12:33am and 1:08am ET.  We ran full Bitdefender and Malwarebytes scan, both came back clean.  Hoping this is just a categorization failure on the Palo Threat detections but seems odd it happened twice in 4 days.   ... View more

Did you happen to see additional events to x1.c.lencr.org late last evening until early this morning (12:33am ET to 1:08am ET)?  We saw them the first time during the time you posted in your original post.   ... View more