This appears, sadly, very legitimate.

For quite a while uk banks have done it with weird URLs. The only bank I know that does this incredibly well is Monzo as their 3D secure URLs are all on veirfy.monzo.com