@drakhonen.eth
Good way to verify these is, scope the official @manifoldxyz site. You will see their primary domain, manifold . xyz. The "app." is the subdomain for the primary app.
I went ahead and tested this for you on an isolated device with endpoint security. This is legit.