New Top-Level Domains as Potential Phishing Risk
Google has recently introduced a set of new top-level domains: .dad, .esq, .prof, .phd, .nexus, .foo, .zip and .mov. They’re now available for purchase, and it’s the last two that are attracting attention due to the risk of abuse in phishing attacks.
WIRED describes why .zip and .mov have raised concerns. “The two stand out because they are also common file extension names. The former, .zip, is ubiquitous for data compression, while .mov is a video format developed by Apple. The concern, which is already starting to play out, is that URLs that look like file names will open up even more possibilities for digital scams like phishing that trick web users into clicking on malicious links that are masquerading as something legitimate.”
There’s another potential problem, the obverse of the first. “And the two domains could also expand the problem of programs mistakenly recognizing file names as URLs and automatically adding links to the file names. With this in mind, scammers could strategically buy .zip and .mov URLs that are also common file names—think, springbreak23.mov—so online references to a file with that name could automatically link to a malicious website.”
Experts are divided as to whether the new domains represent a real increase in the risk of phishing. On the one hand, criminals have been observed purchasing and experimenting with domains that use the new extensions, so the risk isn’t a purely theoretical one. On the other hand, as experienced (and jaded) observers note, users tend to be so careless with respect to URLs, and so easily gulled by malicious domains, that any increase in phishing activity associated with the news domains is likely to be lost in the noise.
Whatever proves to be the case, this is the sort of risk that new school security awareness training can help your people learn to recognize and avoid.
WIRED has the story.
Free Phishing Security Test
Would your users fall for convincing phishing attacks? Take the first step now and find out before bad actors do. Plus, see how you stack up against your peers with phishing Industry Benchmarks. The Phish-prone percentage is usually higher than you expect and is great ammo to get budget.
Here’s how it works:
- Immediately start your test for up to 100 users (no need to talk to anyone)
- Select from 20+ languages and customize the phishing test template based on your environment
- Choose the landing page your users see after they click
- Show users which red flags they missed, or a 404 page
- Get a PDF emailed to you in 24 hours with your Phish-prone % and charts to share with management
- See how your organization compares to others in your industry
PS: Don’t like to click on redirected buttons? Cut & Paste this link in your browser: https://info.knowbe4.com/phishing-security-test-partner?partnerid=001a000001lWEoJAAW