Morphit

Dang, it could be the upstream DNS server passing along client queries. Maybe the ISP?

In that case not even curl would be safe unless you could ensure all queries only resolve on your gear. Either use a host file entry or local DNS server.

Have you sent the URL across any messaging services? Lots of them look up links you share to see if it’s malware (and maybe also to shovel into their AI). Even email services do this.