I clicked claim and the second step was to provide my seed phrase. Immediate red flag right there. I'm hoping they can't do anything without having my phrase. Since it's a different domain there's no way they could have access to local storage or cookie data.
Never give anyone your seed phrase.