Yes, we should all be wary about online safety, but some people seem to be overthinking this.

I opened a new private window and pasted the link there. The top level domain was hilton.com, so I went to it. It didn't ask me for any info but just said the points were in my account.

I then opened the app on my phone and the points had already posted.

Interesting that it was targeted though. Maybe we can work out the criteria? I had 2 stays in 2020 and 11 so far in 2021.