Google Adds ".zip" and ".mov" Top-Level Domains (TLDs) to the Internet, Raising Security Concerns

Summary

In May 2023, Google Registry made several new top-level domains (TLDs) generally available, including .zip and .mov — extensions that double as common file formats. The core concern is that many platforms and messaging apps auto-linkify text that ends in .zip or .mov, meaning a malicious actor could register a domain matching a commonly shared filename and redirect unsuspecting users to a phishing site or malware download.

Security researchers warned that users conditioned to trust those strings as file references could easily be deceived. Google defended the move by noting that its registry has existing mechanisms to suspend or remove malicious domains, and pledged to monitor for new threats. The debate split the security community, with some viewing the risks as overstated and others arguing the new TLDs add unnecessary attack surface to an already risky internet.