The new ".zip" domain is being used almost solely for malware. Some of the clicks are very deceptive, even to technically knowledgeable people. See the attached image for an example.
You can block all zip domains with the following uBlock Origin rule under My Filters:
||zip^
Tell everyone you know.
The slashes in the path part of the first url look different than the slashes in the scheme and everywhere in the second url. So my guess is that the first url is the malicious one.
I would have missed it if I hadn't been looking for a difference though. Thanks for the info.
@bjb @suprjami so basically this is yet another occasion where unicode hurts instead of actually helping.. why can someone register a domain with deceptive symbols in it??
#letsgobacktoasciionly
EDIT: my mistake that everything before the @ is the username, got rightly pointed out to me multiple times. Doesn't make me blame unicode less though, because afaik a forward slash is not allowed in such a username and in this case unicode allows this to look like a "valid" url regardless...
@suprjami
For pihole users (copied from reddit)
Blocking a whole TLD in PiHole:
Log into your PiHole via the web interface
Find "Domains" on the left-hand column and click on it
On the Domain tab in the right window, find the Domain text entry, and add "zip" (without quotes)
In the Comment field, I added "Manual - Google .zip TLD" for my own records
Be SURE to check "Add domain as wildcard" to block the whole ".zip" TLD
Click on "Add to Blacklist"
Repeat for the "mov" domain as well (without quotes also)
@celesteh @suprjami see here, the / in the first url are not real /
https://medium.com/@bobbyrsec/the-dangers-of-googles-zip-tld-5e1e675e59a5
@HydrePrever @celesteh @suprjami Damn. That’s subtle. Unicode for the phishing win here…
That said, the domain is already blocked on my internal DNS servers, but now I’m more seriously thinking about forcing their use even when on public cellular internet connections
witless
Jamie
bjb 
Enara 
❔
dragonfrog
Jon Ribbens
tizilogic
William / HestenettetDK
Decivex
Michael Porter
Paul Wilde 
:dontpanic_nobg:
Sören
noodle
Charles ☭ is now tooting from queer.party
Le Néandertal se sent las, las
Techronic9876
Erik Ableson
Creature Of The Hill 
🌸Lilyana Marie🌸
Mico∕ instead of / and just creating say kubernetes∕kubernetes user with archive as project 
@suprjami What browser are you seeing the @ URL treat v1.27.1.zip as the domain in?
I can only get it to work with pretty trivial URLs; as soon as there's a slash in the username portion, it's detected as the domain/path portion by chrome/safari/curl.
As far as I can tell, https://[email protected] can be used for phishing,
but anything more complicated, like the example you posted, cannot -- e.g. https://github.com/[email protected]
@suprjami I've also updated the DROP blocklists:
https://github.com/greyhat-academy/lists.d/blob/main/drop.domains.block.list.tsv
Know your rights.
Never click any damn thing unsolicited.
Never post unsolicited dick pics.
Never post solicited dick pics.
Never use your personal computer, mobile personal computer (smart phone), for illegal acts.
Never say anything above a whisper that you don't want god to hear. She is listening.
@suprjami I just wrote about those obfuscation techniques:
URL Obfuscation time! I recently read Nick Simonian's [post](https://www.mandiant.com/resources/blog/url-obfuscation-schema-abuse), at Mandiant, about the "Don't @ Me Url Obfuscation" technique. It's a very interesting technique, but it seems to me that the "@" sign in the URL still looks very suspicious, don't you think? ``` http://google.com@3264653699 ``` But what if we could take this technique to the next level? If we could add a slash right next to the fake URL it would look much better. But if we simply add a slash to the example above, the browser will of course navigate to google.com. What if we could find a character that looks just like a slash but is interpreted as a regular character? We can and you guessed it: we can use Unicode characters anywhere before the @ sign and the browser will consider it to be part of the username portion of the URL. Let's use the character U+2215, a division slash, that looks pretty much a regular slash. The unicode character really makes a difference. Look at the URLs below. They look pretty legit, but if you copy any them to your web browser, you will be taken to the web page of Phrack magazine: ``` http://google.com∕@3264653699 http://google.com∕support∕@3264653699 http://twitter.com∕elonmusk∕status∕@3264653699 ``` Chrome/Chromium will simply navigate to the obfuscated address (the IP address of phrack.org in decimal format is 3264653699). Firefox, though, shows a warning that you are trying to log in to the obfuscated IP with a weird username. That should be enough to grab your attention. I think Firefox is doing the right thing, warning the user, and other browsers should also add some protection against this kind of attack. It's easy to fall for this trap, even if you're an experienced computer person. The IP in the address bar should actually raise an alarm in your brain, but what if you just don't notice it? What if you're in a hurry and don't pay attention to it? Browsers can prevent this. #infosec #cybersecurity #obfuscation #phishing
@suprjami Where do you put this rule?
uBlock Origin rule:
||zip^
@suprjami Sadly not surprised it took off like this.
Maybe this will give me an excuse to finally get a Pihole running on my network to block these. I've mainly avoided doing so because of the whole manual process of disabling/whitelisting stuff for which a lot of legit sites still need to function correctly.
@suprjami Extra note: Test your filtering rule by trying to open this test domain: https://canigothere.zip/
If you can open it without getting stopped and see the message, your block isn't working.
@suprjami what's even better is that google use sliding scales for how much any given .zip domain costs.. $dayjob bought one (not a super generic word, but is an umbrella brand we use) for 48 bucks, other versions of the same brand word (but separated out into their two component words) are 680 for one, and 1480 for the other. Per year.
The domains are utterly useless to us, but buying them _might_ reduce some phishing, maybe.
Google, in my opinion, can frankly go get F'd, the greedy @#$%ers
Why the hell did Google decide to use a common file extension for a TLD?!?! That's just stupid!
@suprjami Neither can be determined safe.
Not just because of unicode lookalikes, but also because there's no reason to believe that the legitimate kubernetes source is at either of them without any additional verification.
@suprjami The exceptions that prove the rule
Jim
owls
Lisa
Kevin Karhan 
Stephen Brooks 🦆
Ben S.
Joshua Leung
Atheist Art
The Bear (Stephen Rodda)
Paul Chernoff
madcap 
Ben Taylor
France Jor☝️
Crystale
Olympia Indivisible
Kathy Murdoch
Kay Ohtie 🔜 FWA
Why Not Zoidberg? 🦑
Jonathan👣🚲
Vchat20
Jaime Herazo
genstar.service
Lockely 
Kapitän Clownfeuer
Jørn
Ben Todd
Jan Niklas Fingerle
Andrew Cook
LisPi
embix
SiberCecurity
Dr John A Stevenson
Stephan Deibel 🌼