After quite a few false positive events over a few months, I finally had a legitimate malware alert that checks positive against various malware/malicious URL checkers including Virustotal. This event was when using a national news app on an iPad and reading a news article that has embedded adverts, and even though the adverts were not clicked on, so a drive by type threat with 3rd party web content that the news provider probably has little or no control over.
So it's reassuring to see Armor is actually working.
In terms of the false positives, these apparently malicious URLs checked out, and were similar advert drive by type web browsing, so Armor's/Bitdefender's database is either wrong or out of date if the site hosting the malicious URL has been cleaned up; knows something all the others don't or has a very low, cautious or sensitive thresholds and seems to categorise most advert redirects as malicious.
