Google Registry actually announced eight new top-level domains (TLDs) that day: .dad, .phd, .prof, .esq, .foo, .zip, .mov, and .nexus. Users have a clear idea what .zip means. In his article Bobby Rauch points out the dangers of the .zip TLD. Adversaries can abuse this ambiguity to mislead or misdirect: everything before an @ in a URL is treated as user info, so a link that looks like a GitHub download actually leads to a .zip domain. Citizen Lab’s John Scott-Railton recommends blocking the newly introduced TLD. Netcraft found five .zip domains already used for phishing within two weeks of the launch, impersonating Microsoft, Google and Okta. Google told BleepingComputer that “the risk of confusion between domain names and file names is not a new one” and that Safe Browsing and domain suspension apply to .zip as well.
Evil:
https://github.com∕kubernetes∕kubernetes∕archive∕refs∕tags∕@v1271.zip
Legitimate:
https://github.com/kubernetes/kubernetes/archive/refs/tags/v1.27.1.zip