The content of the email was:
" Message me when you are free https://to.sv/SomeUUID
<list of about 40 users w/ @ sign preceding their github handle>
Hey All my photos and videos here https://to.sv/SameUUIDAsAbove "
Very suspicious. I searched the URL on a malicious link lookup site and found "7 security vendors flagged this URL as malicious"
A lady mentionning something getting wet, many mentions including me and the same type of link others mentionned.
I agree with others that GitHub's reporting process for this kind of behavior is not great. It's good to make reporting take a few steps for cases involving real humans, but for obvious spamming or trolling, there should be a quicker way IMO.
EDIT: I also just got a phishing email saying "Your github account was successfully signed in to but we did not recognize the location of the sign in. You can review this sign in attempt by visiting the link below."
Couldn't find any "report spam" or "report post" link.
I saw that lack too. In a way it felt warm and nostalgic for a earlier, more naive, time of the internet.
But yea, we need that.
Edit: It's in the "Discussions" GitHub tab.
Edit: Got a GH response:
"Our review of the account(s) and/or content named in your report has concluded. We have determined that one or more violations of GitHub’s Terms of Service have occurred and have taken appropriate action in response."
These issues have hundreds of replies, and GitHub has UX problems on large issues: comments you're tagged in aren't immediately visible, which discourages reporting (it may take ~2/3 minutes to expand a conversation to find and report it).
It discourages future contributions to repos I don't maintain.
I'm replacing the specifics with words in "<>", but here's the title of my mail from notifications@github.com:
Re: [<user>/<repo>] <what looks like an issue title> (Discussion <#number>)
Edit: and another…