Newly launched .zip already looks dodgy - Domain Incite

RSS Feed

Twitter Feed

Latest news of the domain name industry

Recent Posts

Newly launched .zip already looks dodgy

Kevin Murphy, May 15, 2023, 10:41:23 (UTC), Domain Registries

A trawl through the latest zone file for Google’s newly launched .zip gTLD reveals that it is likely to be used in malware and phishing attacks.

.zip is of course also a filename extension used by the ZIP archive format, often used to compress and email multiple files at once, and many domains registered in the .zip gTLD in the last few days seem ready to capitalize on that potential for confusion.

I counted 3,286 domains in the May 14 zone file, and a great many of them appear to relate to email attachments, financial documents, software updates and employment information.

I found 133 instances of the word “update”, with sub-strings such as “attach”, “statement”, “download” and “install” also quite common.

Some domains are named after US tax and SEC forms, and some appear to be targeting employees at their first day of work.

I don’t know the intent of any of these registrants, of course. It’s perfectly possible some of their domains could be put to benign use or have been registered defensively by those with security concerns. But my gut says at least some of these names are dodgy.

Google went into general availability with eight new TLDs last Wednesday, and as of yesterday .zip was the only one to rack up more than a thousand names in its zone file.

The others were .dad (913 domains), .prof (264), .phd (605), .mov (463), .esq (979), .foo (665) and .nexus (330).

Related

Tagged: .zip, google, malware, new gTLDs, phishing, security

Add Your Comment

Recent Comments

Snoopy: He paid $460,000 for the picture. Probably a big mistake to double down on this stuff.
Girish: So who won the TSP backend infra project development for IN Registry?
Anthony Mitchell: Mao wanted to abolish character scripts and shift to a Romanized system for writting Chinese. He jus
Rubens Kuhl: While I don't know the specifics, most registrars are very wary of low-volume and/or rule-heavy gTLD
Josh: So, the first step in rebuilding a brand and establishing trust and transparency is to falsely accus
Amadeu Abril i Abril: Goood to see .post moving forward. But the question is: how is it possible that they have accepted o
shop.wwwbrand.com: XXXURL.com - BIN $25 on Epik. Previously owned by Mike Mann
Jovenet Consulting: Finally, we're getting there...
Rubens Kuhl: Web3 is like AOL content back in the days, you either have the software or you can't get to it. Look
John Berryhill: "Pretty outlandish stuff, based on some pretty flimsy arguments." He's been pursuing this idiotic
Matthias Pfeifer: Page, there IS already a market. The job you (and the others) will probably have to do is to inclu
A Domain Registrar: Oh fan-bloody-tastic. Yet another opportunity for string confusion, phishing and excuse to sell a wh
Matthias Pfeifer: You are right Rubens, but what Barret said: "We don’t know the answers yet.." And I am prett
page howe: so i realize this is a rarely held, and much criticized opinion.. but being able to start a Web3
Andrew: Interesting to note that IONOS seems not to be selling Registry Services LLC (Godaddy Registry) new
Rubens Kuhl: If someone had a business plan including a TLD launch, and it ends up in contention, there shouldn't
Avri Doria: Given that every new rule, no matter how draconian, creates new opportunities for those who skirt ru
Jovenet Consulting: Did I read "against Russia"? 😂
Kevin Murphy: I was mistaken. There aren't any. I think I might have found collisions.
Tom Barrett: What are the included Handshake TLDs?
Kevin Murphy: Would it really be new precedent? Doesn't ICANN always bend over backwards to get pre-2012 RAs conve
Rubens Kuhl: With IFFOR gone, my odds of receiving owed money from Kieren McCarthy are also gone.
Rubens Kuhl: Do you mean like .sucks, clearly inspired by .xxx ?
John Berryhill: The interesting question is that, in view of the longstanding and multiple breaches of the registry
Rubens Kuhl: Not all ccTLDs publish zone files, which monitoring systems usually process.
John McGarr: These blocking services are a little far-fetched. Let's look at it logically. Data shows threat acto
Matthias Pfeifer: WTH would one use a not-working framework on DNS Abuse? Hypocrits..
Rob Golding: There remain no functional 'consumer protections on domains, which is especially clear with the ongo
Simon: You might also be interested in the following FOI request: https://www.whatdotheyknow.com/request
Symon Andrade: One of the problems with new gTLDs is the instability and frequent price changes, which in my opinio
R. Funden: In memory of an old SNL sketch: clownpenisdotf.art, anyone?
Thor: This is not a protocol error. For a more non-sensational article, read ISC's post about it, at https
Rubens Kuhl: This was just to show that a draw may involve no-cost tickets. Registration with CA authorities is t
Kevin Murphy: Perhaps ICANN's lawyers are being cautious. If you pay $250,000 and get a "free" ticket, how free is
Rubens Kuhl: From the same reference: "Registration is not required if all tickets for a drawing are free, solic
Kevin Murphy: From https://oag.ca.gov/charities/raffles A raffle is a type of lottery in which prizes
Observer: It is amazing how such a small team can consistently spawn thoughtleading products.
Rubens Kuhl: While the draw was bound to come back, the ticket purchasing system doesn't have to, and might chang
tom barrett: These same outcomes are coming to "immutable" web3 naming services and resolvers.
Helmuts: Well said, Rubens! -- It is simple, for a UK company to signal local presence: they need to be
Rubens Kuhl: While Russia is formally in the list, securing OFAC license for providing applicant support is going
Kevin Murphy: To be clear, we're talking about small businesses based in these countries. Not their governments.
R. Funden: Why is ICANN sponsoring benefits for an aggressor country like Russia? This is out of line!
Rubens Kuhl: It's only application fee. If approved, at least USD 25k in ICANN fees would go down the drain, with
wwwbrand.com: Hi, Great news. What's renewal fee? $40K is it one-time fee or per year?
Elisa Cooper: Really? We are 12+ years since the launch of new gTLDs. Wouldn’t any valuable names have long been
Kevin Murphy: Thanks, that's the second time I've done that so far this year.
Mike SMith: Did you mean 2026 rather than 2016?
Mike Q.: Yeah no I'm still getting the few domains I have left with them out. The company is folding due to
Kevin Murphy: The next round is likely to be a bit stricter on applicants applying just to lose their private auct