Bug - Improper headers for blocked content

Dear all,

While toying around with cURL and Sophos Anti-Virus, I noticed that the Web Protection service:

▸ Returns a 403 Forbidden error when the domain's reputation is deemed unsuitable

▸ Returns a 200 OK error when the content is blocked

Compare, for example:

▸ Loading the Sophos malware-blocking test page

$ /usr/bin/curl --compressed "http://sophostest.com/malware/" -sI
    HTTP/1.1 403 Forbidden
    Content-Length: 6865
    Content-Type: text/html; charset=UTF-8
    Cache-Control: no-cache
    Connection: close
    Proxy-Connection: close

▸ Loading the Eicar.org pseudo-virus

/usr/bin/curl --compressed “www.eicar.org/.../eicar.com.txt" -sI
    HTTP/1.1 200 OK
    Date: Fri, 03 Jul 2015 12:20:55 GMT
    Server: Apache
    Content-disposition: attachment; filename="eicar.com.txt"
    Cache-control: private
    Content-length: 68
    Content-Type: application/octet-stream