If the scheme is not lowercase it seems to erroneously detect malware and provides a zip file url for some malware which does not exist on the page. Seems like a bug !
example URL "with" malware: Https://cnn.com
example URL without malware: https://cnn.com
example URL "with" malware: Https://cnn.com example URL without malware: https://cnn.com