You're correct - at least one of the subdomains (hacker news) is on CF and I assumed the main site was on it too. I don't know how Adobe flagging works - it's

You're correct - at least one of the subdomains (hacker news) is on CF and I assumed the main site was on it too. I don't know how Adobe flagging works - it's possible that detecting an issue on a subdomain would cause them to flag the apex. That being said, the same recycled-IP issue could apply to the Amazon load balancer / CDN. [Edit] Looks like they do indeed classify by apex. So, news.ycombinator.com redirects to ycombinator.com on the Adobe database, e.g. https://safeweb.norton.com/report/show?url=news.ycombinator.com https://safeweb.norton.com/report/show?url=news.ycombinator....