Oh no, I think sophos is gobbling up my first response. It's visiting the page before relinquishing control.

Quite a lot of security software previews request to check for anything dangerous or suspicious, especially with email links (our does as well), and will sometimes remove or modify the link if it suspects phishing or some other risk