Furthermore, companies and developers should ensure that their tools, scripts, and applications do not rely on filename extensions, but instead should check the file type based on the file headers - otherwise a URL could trigger unwanted or risky behavior from these tools and scripts. Hovering the mouse cursor over links can provide a preview of their actual intended URLs. Organizations and individual users can protect themselves from attacks that exploit TLDs by staying vigilant and exercising caution when receiving URLs with unfamiliar top-level domains (TLDs) and avoiding clicking on them unless certain that they are legitimate. However, we will continue to monitor any related URLs we come across and block them as needed in preparation for potential phishing campaigns. In extreme cases, organizations might resort to blocking all URLs using potentially exploitable TLDs since there is a high chance that they will be used for malicious purposes.Īs of today, Trend Micro has not yet received URLs related to these new TLDs from internal and customer cases. zip TLD with the delimiter, these websites could have been even more convincing as legitimate Zoom download URLs to potential victims.Īside from malware delivery, these TLDs could be used in other ways, for example as a command-and-control (C&C) server. In other words, the ” is just a delimiter. This just means that the URL before is, in practice, ignored and just act as a mask, whereas the one after the symbol is the actual target URL. In an example provided by Medium’s Bobby Rauch, accessing the URL shown in Figure 1 will direct a user to instead of. zip TLDs, one of the things that make it a potential security concern is the use of the operator on a website URL. These websites are often used as referrer URLs that redirect to the malicious URLs. The use of legitimate websites for masking malicious URLs to avoid detection and minimize suspicion is a technique that cybercriminals have used for a long time. Primary security concerns Hiding malicious URLs behind legitimate websites In this blog entry, we will examine these security risks while also providing best practices and recommendations on how both individual users and organizations can protect themselves from these hazards. Although seemingly harmless at first glance, it sparked discussion and debate across the internet since these domains can pose security risks due to cybercriminals exploiting them for malicious purposes. In May 2023, Google launched eight new top-level domains (TLDs) that included.

Alarm vector icon