".Zip" top-level domains draw potential for information leaks
Summary: Google released eight new top-level domains in early May 2023, including ".zip", and Talos reports a suspiciously high volume of registrations of ".zip" domains resembling internal company filenames. Because browsers and chat applications like Telegram read strings ending in ".zip" as URLs and may trigger automatic DNS or web requests, Talos observed DNS query data leaking project names, PII, employee IDs and business relationships to domains their owners control.
Why it matters: Anyone controlling a ".zip" domain's DNS server can filter requests by the networks of the companies they target and collect internal filenames for use as lures in a later attack - and a filename merely mentioned in a chat can be enough to send the query.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026