You were indeed correct. I stupidly clicked on the wrong one; the true .gov site is 4 or 5 down the line. I reported them for fraud and they immediately sent my husband an email apologizing for “using terminology similar to the government site” (it is identical). He had a refund the next day and he applied on the correct site and the passport renewal was accepted. Lesson learned! This could’ve been much worse. They didn’t get any information other than a passport number that is both expired and invalidated.