Today's phishing email almost looks legitimate initially. Then:

[1] You wonder why your domain registrar would be writing to you from a non-existent email account on your own domain.

[2] You note that the link you're asked to click goes to https://webmail_verify_domain_contact.winrio.vu/Roundcube.html which seems ... unlikely.

Or is this a false positive?