The new ".zip" domain is being used almost solely for malware. Some of the clicks are very deceptive, even to technically knowledgeable people. See the attached image for an example.

You can block all zip domains with the following uBlock Origin rule under My Filters:

||zip^

Tell everyone you know.

I typed 'subprocess.run' into my browser looking for the docs for the #Python function. It took me to some scammy malware page. '.run' is another new top level domain to watch out for, along with '.zip'