Yes, URLs like that are commonly used in phishing emails, so that's my hunch as well. They're just not recognizing that such strings can appear in domains so I

Yes, URLs like that are commonly used in phishing emails, so that's my hunch as well. They're just not recognizing that such strings can appear in domains so I suspect it's a simple bug but probably not one they'll fix.