In the vast expanse of the internet, where innovation meets uncertainty, a recent discovery has sent shockwaves through the world of cybersecurity. Two seemingly harmless top-level domain names, .zip and .mov, have emerged, but beneath their innocent facade lies a hidden danger. Security researchers have uncovered the potential for these domains to construct malicious URLs, fooling even the most tech-savvy users. Join us as we embark on a gripping exploration of these new domains and the risks they pose to unsuspecting individuals.

News of these new top-level domain names spread like wildfire, accompanied by a sense of curiosity and concern. A dedicated security researcher delved into the matter, driven by a quest for truth. What they uncovered was both chilling and alarming. By manipulating URLs using intricate techniques such as unicode slashes and the inclusion of an "@" sign, malevolent actors could redirect users to harmful websites instead of the expected download from a trusted source. The trust we place in the internet shattered, leaving us vulnerable to digital miscreants.

Seasoned experts in cybersecurity analyzed the situation, carefully dissecting the dangers these domains presented. Their findings revealed a disturbing reality. The combination of a top-level domain mimicking a common file extension, paired with a sophisticated lookalike attack, formed a potent weapon for those seeking to exploit the unwary. These domains excelled in executing drive-by download attacks, silently planting malware on unsuspecting devices. The stakes were raised, and the battle for digital safety took a sinister turn.

As the news spread, alarm bells rang throughout the cybersecurity community. Security firms prepared for the looming threat, standing as guardians against the encroaching darkness. Infamous malware strains exemplified the menace these domains posed. Cybercriminals, armed with fake URLs, enticed victims with promises of harmless files, such as a "Zoom.zip." However, with the .zip domain at their disposal, the attackers' malicious intent became far more insidious. Innocent individuals were ensnared, their lives tainted by the destructive power of these deceitful domains.

Microsoft Account phishing employing ZIP domain for advanced cyber deception

How threat actors can make phishing URLs that look like legitimate file download URLs at GitHub but actually take you to a website at v1.22.22[.]zip when clicked, as illustrated below.

Beware of fraudulent links that falsely claim to provide file and video downloads, utilizing domains with the extensions .zip and .mov.

Tips for users to enhance their online security:

• Think before you click: Study links closely before clicking on them. Look for any suspicious or misspelled URLs that may indicate a phishing attempt.
• Beware of unsolicited emails: Exercise caution with emails from unknown senders, especially those with attachments or requests for personal information. Phishing emails often create a sense of urgency or curiosity to trick you.
• Be cautious with attachments: Avoid opening attachments from untrusted sources, especially if they are unexpected or appear suspicious. Malicious attachments can contain malware that can harm your device.
• Verify URLs: Double-check the legitimacy of URLs, especially in emails or messages. Scammers may use deceptive URLs that resemble legitimate websites. Look for "https" and a lock symbol to ensure a secure connection.
• Keep your devices secure: Use proper security measures on all your devices, including antivirus software, firewalls, and regular system updates. Protecting your devices helps prevent unauthorized access and malware infections.