Unpacking .zip: A First Look at Domain and File Name Confusion

The namespace for filenames and DNS names has overlapped since the introduction of DNS in 1985: $\mathtt{\text{.com}}$ was the original binary format used for DOS and CP/M systems. Recently the introduction of gTLDs such as $\mathtt{\text{.zip}}$ and $\mathtt{\text{.mov}}$, coupled with the growing prevalence of web resources, has ignited new concerns about potential issues related to DNS and filename confusion. Thus far, the discourse on DNS/filename confusion has been piecemeal and hypothetical, making it unclear what, if any, security concerns credibly exist. To address this gap, we provide the first enumeration of how DNS/filename confusion can be abused. We then perform the first empirical case studies of DNS/filename confusion in the wild, which highlights suspected confusion across a wide range of software. Finally, based on our preliminary findings, we provide suggestions and guidance for future research on this topic.