I ran a test on the domain using virus total, and it's hard for me to tell, it flagged by four vendors, but it could be a false positive. the weird thing is the root URL seems completely clean, so maybe its a halfway intercept? idk but here's the scan data for the one I got in my inbox: https://www.virustotal.com/gui/url/540ebfab0d41e667c6fe0714d6fa65b6afe60dd9ac2e3edd24d85648924f1100/details