add https:// and your browser will take you right to https://package.zip
Yes? When you hover the first link the browser says "v1271.zip", and when you hover the second link it says "https://github.com/kubernetes/kubernetes/archive/refs/tags/v..."
You don't even need a .zip domain to do this, just assign a misleading link i.e. [google.com](badsite.com). If the argument is going to be no one looks at the on hover link preview, then why bother even paying for a .zip domain in the first place? Going further, you can also just buy a similar domain to confuse people, which might even work better than buying the .zip since then you _might_ even catch careful people that glance at the on hover preview.
Of course, there’s nothing unique about `.zip` other than that it’s a common file extension. Any TLD that makes for a convincing file extension could be used this way.
Sorta like https://verylegit.link but built into the whole TLD.
Doesn't change the underlying issue, but plain text email would have stopped that part of it!
Of course, that's banned at work because then the signature wouldn't have the approved font and picture in it, and therefore it's not Corporate (TM) enough.
I think it would be far more of an issue if .lan or .local were ever able to make it past icann for a registrar. What's funny to me, is the number of web forms that haven't been updated to allow anything other than .com/net/org for signup.
||zip^
https://www.cio.com/article/220242/the-webs-10-most-shady-ne...