from time to time we have some false positives on APT. If I check the URL with VirusTotal often Sophos is the only vendor where the URL marked as "Malicious". An example is this URL: https://coronalevel.com/Germany
If I check the URL https://coronalevel.com (without /Germany) at VirusTotal Sophos reports this URL as "Clean". Both URLs have some text and the actual corona chart.
Thank you for contacting the Sophos Community.
Have you submitted a sample of the URL to the following URL? if not, please do so, it might take up to 5 business days for the change to reflect.