It was a Signal link. It had Derek’s NIP-05 address but it showed as not being verified. That was the red flag for me.