Malware/Virus tagged on TLS stream

[mokaz]

Hi there,

I recently spotted some ZA alerts which, according to my readings, is solely matched by an SNI and gave it a Malware/Virus tag:

Destination hostname: fdroid.link
Destination IP: 37.218.243.44
Destination port: 443
Destination username: -
Direction: out
Dst Nbytes: 5514
Dst Npackets: 11
Encryption: TLS-Encrypted
Tags: Malware/Virus Encrypted SSL SSL V3 Web Browsing

Can you confirm my verdict? In fact simply browsing "fdroid.link" would trigger such alerts, this while zero DPI/ssl inspection are enabled.
On what exactly is your judgment made?

Let me know,
m.