The new ".zip" domain is being used almost solely for malware. Some of the clicks are very deceptive, even to technically knowledgeable people. See the attached image for an example.
You can block all zip domains with the following uBlock Origin rule under My Filters:
||zip^
Tell everyone you know.
The slashes in the path part of the first url look different than the slashes in the scheme and everywhere in the second url. So my guess is that the first url is the malicious one.
I would have missed it if I hadn't been looking for a difference though. Thanks for the info.
@bjb @suprjami so basically this is yet another occasion where unicode hurts instead of actually helping.. why can someone register a domain with deceptive symbols in it??
#letsgobacktoasciionly
EDIT: my mistake that everything before the @ is the username, got rightly pointed out to me multiple times. Doesn't make me blame unicode less though, because afaik a forward slash is not allowed in such a username and in this case unicode allows this to look like a "valid" url regardless...
Jamie
bjb 
tizilogic
William / HestenettetDK