If you google 'sophos malicious url test' you get sophostest.com and a subpage sophostest.com/malware.
Surely SAV should alert on this page as a test/check for Web Control functioning correctly?
FYI: I just went to a real malicious website as a test and SAV blocked that so WC is on.
This thread was automatically locked due to age.