That's interesting. It looks like the link is active, but the request to github.com results in a 302 redirect to S3. I don't know what that would mean in this

That's interesting. It looks like the link is active, but the request to github.com results in a 302 redirect to S3. I don't know what that would mean in this type of scenario (phishing) either. I wonder what an html attachment would look like...