That is normal behavior from AVs.
It’s a false-positive.
Antiviruses sometimes do that either because of the .xyz TLD (Top Level Domain, aka the last part of a domain) or either because the program might contain code that triggers the AV.
Just add an exception (or whitelist them, or whatever they’re called) for the domains and/or programs needed.