Why would sensei block requests to *.attdns.com under block category:web category and categorizes it as malware/virus.
Similar to IDS, it takes a bit of tuning to get the categories 100% for your environment. When you first turn on Sensei or make policy changes it is good practice to check to see what is being blocked via:
Sensei > Reports > Blocks > Live Blocked Sessions Explorer
Then add any necessary exceptions. Be careful not to whitelist entire categories which is the default. Just select the "hostname" radio button.