When “invoice.zip” is a website, not a file
The new .zip and .mov domains make links that look like file names. Teach people to check where a link really goes.
Google has opened the .zip and .mov top-level domains to everyone. So invoice.zip or update.mov can now be a real website, and chat apps and email clients turn them into links automatically.
You can see the problem. A message says “the report is in report-2023.zip”, and the link opens a site someone registered last night, maybe with a download waiting.
Some security researchers have also shown links where the visible text looks like a normal GitHub download and the real destination is a .zip domain, using lookalike slash characters.
What helps:
- Check where a link really goes before clicking: hover on a computer, long-press on a phone.
- Files come as attachments or from your known storage, not as links to strange domains.
- If your company doesn’t need them, block .zip and .mov domains at the web filter or DNS level.
- Watch for new registrations that look like your brand.
Old habit, new reason: the text of a link isn’t the link.