ATP false positive?

Hello Communitiy,

from time to time we have some false positives on APT. If I check the URL with VirusTotal often Sophos is the only vendor where the URL marked as "Malicious". An example is this URL: https://coronalevel.com/Germany

If I check the URL https://coronalevel.com (without /Germany) at VirusTotal Sophos reports this URL as "Clean". Both URLs have some text and the actual corona chart. 

Ben



Edited TAGs
[edited by: emmosophos at 4:49 PM (GMT -8) on 14 Jan 2022]