I've been sent random links to a website, christmas.riotpromotions.com , from a few friends. I've told them the same thing: it is probably a spam website and I wouldn't trust it.
I'm not the tech-savviest person in the world, but I did a WhoIs search and found that both league of legends (dot) com and riot (dot) com share the same registered owner, where as riot promotions (dot) com has a private registrar. Very unlikely that a company would register a domain name (in august of this year) and not use the same information/service as before.
The URL is also kind of a giveaway - Riot doesn't refer to it as "Christmas", it is "Snowdown." And going to riotpromotions.com doesn't give you a list of "promotions" but some kind of default website you'd expect from a registrar. I'm asking solely because my friends insist it is legit, and I need confirmation from a Red before I'll believe them.