Hey you're right. But yes, it's legit, without the https it also works.

I'll drop them a line to warn of this, thank you.