4 ms·

You can be on a legitimate, trusted web site or be reading a legit, trusted email from a contact and still have a link slip in there. Other commenters like xsma

• reqrbHVPetKGE57 3y ago
  Or the attacker could've just sent you ... a link to familyphotos.zip. I'm not sure why you're bringing client-side auto-vivification (which yes, is a bad idea) into the picture when the attacker could equally send a link. I'm also not sure why you assume that clients will begin to auto-vivify .zip links just as a result of it existing, nor why you assume that's any worse than them auto-vivifying https://example.com/familyphotos.zip https://example.com/familyphotos.zip.
• askiiart 3y ago
  hxxps:[//]]familyphotos.zip (broke the link on purpose) is already registered, and it downloads the zip file. 4 days later, and unsurprisingly, it's already happened. I'll open the zip in a VM and see what happens, it's 0.58 KB... Update: Turns out it just contains what_happened.txt, a copy of which is below. Thanks anonymous person! ``` "Hey, this isn't family pictures!" You're right -- and that link you clicked wasn't a file attached to the email or message you received. Thanks to Google[0][1], now it's impossible to discern the difference between a link to an attachment called "familyphotos.zip" and a link to this file... unless you are able to inspect the destination of a link before clicking it. Most software and apps don't allow that, and most people don't know how to tell the difference anyway. Have fun in the Wild Wild Web! [0]: https://www.blog.google/products/registry/8-new-top-level-domains-for-dads-grads-tech/ https://www.blog.google/products/registry/8-new-top-level-do... [1]: https://twitter.com/Google/status/1653866291692728320 https://twitter.com/Google/status/1653866291692728320 ```