Why?

Earlier this month, Google made several new top-level domains, including .zip and .mov, available for anyone to purchase for a website.  Due to the potential for phishing, malware, and misdirection of users, WPI Information Security has blocked these domains on the WPI network.

Impact

Beginning May 19, 2023, .zip and .mov domains will be blocked on the WPI network. Lookup for systems that are part of the .zip or .mov domains will return an internal security landing page instead. 

Action Needed

If you genuinely believe you need access to a legitimate .zip or .mov site, please contact Information Security using Get Support (below). You can learn more about .ZIP and .MOV domains in the linked article from BleepingComputer.

Details

How these sites could be a dangerous cyberthreat

The new domains .zip and .mov are also extensions of files commonly shared in forum posts, messages, and online discussions. These are now likely to be automatically converted into URLs by some online platforms or applications.

If clicked, rather than obtaining the intended file from the trusted source, the link could now be sending you to a website using the same name. If that .zip or .mov website is owned by a bad actor, you could be the victim of a malware download or phishing scam.

To prevent this from occurring on WPI's network, .zip and .mov domains have been blocked.

What should you do?

Continue best practices to protect yourself from phishing and malware. While you do not need to take any new specific action, be aware of the sites you visit and follow these guidelines:

  • It is never safe to click on links from people or download files from sites you do not trust.
  • Like any link, if you see a .zip or .mov link in a message, research it before clicking on it. If you are still unsure whether the link is safe, do not click on it.
  • Be extremely careful when online; exposure to .zip and .mov links will likely increase as more applications automatically turn filenames with these extensions into links.

By following these guidelines, the new .zip and .mov website domains should only have minimal impact and not significantly increase your risk.