> hovering over the link looks legit enough

You get a pretty different result if it's just "http" and not "https" though: The zip domain looks like just the file name instead of a URL.