What I mean was your wording implied that exchangerate-api.com was somehow implicated, but in my opinion that is too much of a leap to make.

The only thing implicating that site is a redirect that you got from a site that you know you don't trust.