Multiple (major) services are detecting opencode's domain as malicious. Presumably SFR uses those feeds. Check virustotal it the URL