New Things to be Cautious of on the Internet
On May 3rd, Google released 8 new top-level domains (TLDs) -- these are new values like .com, .org, .biz, domain names. These new TLDs were made available for public registration via any domain registrar on May 10th.
Usually, this should be a cool info, move on with your life and largely ignore it moment.
Except a couple of these new domain names are common file type extensions: ".zip" and ".mov".
This means typing out a file name could resolve into a link that takes you to one of these new URLs, whether it in an email, on your tumblr blog post, a tweet, or into file explorer on your desktop.
What was previously plain text could now resolve as link and go to a malicious website where people are expecting to go to a file and therefore download malware without realizing it.
Folk monitoring these new domain registrations are already seeing some clearly malicious actors registering an setting this up, some squatting the domain names trying to point out what a bad idea this was, some already trying to steal your login in credentials and personal info.
This is what we're seeing only 12 days into the domains being available (only 5 days publicly available).
What can you do? For now be real careful where you type in .zip or .mov, watch carefully what websites you're on, don't enable automatic downloads, be very careful when visiting any site on these new domains, and do not type in file names without spaces or other interrupters.
I'm seeing security officers for companies talking about wholesale blocking .zip and .mov domains, and that's probably wise.