That’s what I was thinking. The account reposted a Bolt12 address using the domain, and their zapping address is also at the HRF.org domain, so it’s probably fine. An impersonator would probably set a different zaps wallet (or a smart one would change it later)