The most obvious sign it was a phishing attempt…

- your domain is primal.net

- they linked back to a similar, but different, domain