Introduction to an existing ecosystem

The dangers with .zip domains lie with its introduction into the existing online ecosystem of traditional naming systems. Although that is a mouthful to read, the concept is easy to understand. A large percentage of software and the internet display zip files when shared as ‘filename.zip’ (like Twitter (X) for example), a decades-long habit that worked without hiccup, until the introduction of .zip domains. 

This same traditional naming system for sharing .zip files, ‘testzip’, can now be easily abused by registering ‘test.zip’ as a domain. The system for directing people to domains overrides the file naming system, so instead of the expectation of downloading a file when clicking ‘test.zip’, the user would now be directed to a website. This is where the scammers come in.

Dangerous Content

Scammers are registering .zip domains to take advantage of the new override in the linking system, hosting websites with malicious content targeting vulnerable internet users.

The websites themselves can mimic a whole range of scams; they could automatically download a zip file of the same name that instead holds dangerous content or create a legitimate looking form that you are required to fill out to download your ‘content’ that instead steals your information, the possibilities are truly endless.

Auto-Generated Traffic

The biggest danger and new advantage from scammers, comes from the organic nature of the traffic. The creation of a website or file to scam an unwary internet user has always been the easiest step, the success of a scammer inevitably come down to their ability to distribute the scam as wide and efficiently as possible. 

Welcome .zip domains, a scammers new best friend. Scammers no longer need to seek to entice potential victims to click on their link, instead they can sit back and passively wait for unknowing people to accidently create links to their content. Commonly created and sent zip file names such as photos. holiday. untitled. etc can now be links to domains created by scammers hosting malicious content. At the time of writing untitled.zip is currently listed for sale at 9,999 EUR on sedo.com. 

The main issue here is that the links themselves appear to be legitimate as they are sent from a trusted sender and there is little to be done to avoid it. For example, you could be sat in person with a friend sending you a zip file ‘test.zip’, you see them create the file, upload it, and send you the file via 'tezt.zip’ via Twitter. However, once you click the teste.zip you are instead directed to a malicious website due to the traditional naming system, the only way to avoid the scam is not click on .zip links at all.