New TLDs are available. .zip and .mov and it seems a bit concerning

I found a great comment by u/LudwikTR >I feel like most people in the comments are not understanding the mechanism that makes this potentially problematic. I will admit that the author of the website, focusing primarily on his disdain for a particular corporation, doesn't help clarify the point. A **significant** amount of software automatically converts parts of text that *appear* to be URLs (even without an explicit protocol) into clickable links. These include mail clients, messengers, internet forums, social media sites, CMS systems, text editors, etc. Until now, such software would convert *hello.com* into a clickable link (since .com is a valid TLD) but would leave *hello.zip* as is (since .zip wasn't one). This won't change overnight, but gradually it will, as software libraries are updated with the current list of valid TLDs. This means that soon, whenever anyone mentions a zip file by name (in a message, email or a post), it will inadvertently become a link. To the reader, it will appear as if the author intentionally linked the file to assist the reader in finding it (e.g., "Then you need to download [documents-backup.zip](https://documents-backup.zip) from our intranet portal"). So, they'll click on the link expecting to download the file. As an attacker, all I have to do is register the *documents-backup.zip* domain and upload a malicious zip file to the root of the domain. It will starts downloading as soon as someone opens http://documents-backup.zip. The individual clicking on the link expects a zip file to download - and it will, but it will be a malicious file from a third-party, not from the author of the message or a post. So as a result we get a **trusted** source inadvertently linking to a malicious file, which is very different from scenarios discussed in other comments. **EDIT:** There were questions whether a zip file can be downloaded by simply accessing the root of a domain so I registered the domain and created a simple demo here: [documents-backup.zip](https://documents-backup.zip)