It's legit (you can follow the chain from the announcement on Equifax.com) but horrible practice. Should've been a subdomain - they're just training folks to fall for phishing scams this way.