.zip Domains Can Expose Internal Filenames Through Unintended DNS Requests
Summary
Talos says apps that interpret .zip filenames as URLs can trigger DNS or web requests, exposing internal filenames to domain owners. The leaked names may aid phishing and social engineering; organizations can monitor requests and consider filtering .zip domains.
Key points
- Messaging apps and browsers may automatically link strings ending in .zip, triggering DNS lookups or web requests.
- Windows Explorer may search online for a missing .zip file, potentially resolving it as a domain.
- Talos observed DNS queries containing filenames that could reveal project names, personal identifiers, business relationships, and other sensitive details.
- Attackers controlling matching .zip domains could collect leaked filenames and use them to craft phishing lures or support reconnaissance.
- Talos cited Umbrella telemetry and open-source research indicating that many .zip domains had been registered, including names resembling internal files.
- Defenders can monitor for these requests and consider blocking .zip domains, with case-by-case exceptions; the article also identifies applicable Snort SIDs 61861–61864.
Article Details
- Event Type
- Potential information disclosure and phishing risk associated with .zip top-level domains and automatic DNS or web requests triggered by filenames.
- Impact
- Unintended requests may reveal internal filenames and potentially sensitive information, including project names, personally identifiable information, and business details, to whoever controls the queried domain. Talos describes this as a risk and reports observed filename queries; it does not confirm a resulting breach.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | secure-access-4a907q5xsg5q5354[.]fbmsg[.]xyz[.]zip | Cited by Talos as an example of a .zip domain seen in DNS data that could indicate a phishing attempt; malicious use is not confirmed. |
MITRE ATT&CK
People
Vendors
CiscoDNS resolutions or using these domains as launch points for potential exploits and malware artifacts. Cisco’s Umbrella telemetry and open-source research indicate that many of these domains may be used forGoogleGoogle’s recent offering of the “.zip” top-level domain (TLD) has led security researchers and likely threat actors to register numerous domains for red teaming and phishing attacks, respectively, causing new challenges
Products
SnortOpen-source Snort Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org.Umbrellaor using these domains as launch points for potential exploits and malware artifacts. Cisco’s Umbrella telemetry and open-source research indicate that many of these domains may be used for malicious attacks