I clicked on a link for the subdomain of a trusted website (the subdomain slackin.brilliant.org of the website brilliant.org), and instead of being directed to another page, a file called "download" simply downloaded onto my computer. I deleted the file right away, so I don't know its contents, but I was worried that maybe the file had malicious contents (could Brilliant.org maybe own a domain and not have control of this subdomain, therefore allowing perpetrators of malware to capitalize on this?).
Nothing malicious is going on. The file is empty.
This happens when there is a misconfiguration of the webserver and instead of serving a page to display, it transfers the target as a file. In this case, there was nothing to transfer.
This sort of thing was a lot more common in the early days of the web, but I'm shocked to see it these days.