It looks super fishy: Needed password reset (so they don't have the password hashes), high fees (0.25% withdrawel fee), and you need to upload your whole life in documents (ID, utility bill, tax report etc.)
And indeed looks suspicious.
But, the domain name looks like to be explicitly listed on the Cyprus sec website: https://www.cysec.gov.cy/en-GB/entities/investment-firms/cyp...
And it would make sense that if they cut off the system/backend that were using before, they would need something like the password reset. Previously auth might even have been handled by ftx main service.