It's impossible to guarantee any GTS Pokemon isn't hacked, but I'd say it's unlikely for this Vulpix. I have many Pokemon just like it. Their origin story is actually pretty simple.
This Vulpix is what the breeding community calls a breedject (which is a blending of "breed" and "reject"). You can verifying this by putting it through the stat judge and checking for deficiencies in its IVs.
The term is a bit cruel: basically the person you traded with was attempting to get a 6 IV Vulpix through breeding. They would have hatched the Pokemon you have, seen it's missing a valuable IV somewhere, and set it aside to keep trying for 6 IVs.
Once breeders finally get their 6 IV prize, they'll usually have at least a dozen breedjects left over in the PC. Most of the time, they're simply released to free box space. But there's a more economical (if annoyingly time-consuming) solution, which is to put them on the GTS for a specific Pokemon in return. The requested mon could enable an egg move the person wants or act as a parent in their next project.
For avid breeders with a good breeding Ditto, accessing 6 IV Pokemon is almost too trivial, so Pokemon like this that look fantastic (but are just slightly deficient) aren't so hard to come by. You can often spot breedjects on the GTS if they have a somewhat fitting Pokeball, like your Vulpix does. If you get smart with it, you can find some pretty amazing things. I once traded for a 4 IV HA Lure Ball Totodile with Dragon Dance on the GTS, which I then bred myself and ended up with a 6 IV Feraligatr.
One thing to be aware of is that the person you got the Vulpix from was likely using a hacked/cloned 6 IV Ditto to breed. Despite this, the offspring it makes is 100% clean and tournament-legal. There is still the possibility your Vulpix is hacked as well, and I'd have greater suspicions if it turned out to be 6 IV itself, but the breedject economy is too large and makes too much sense for that to be a likely answer.
