whois isn’t much use any more, but registrar doesn’t match: $ whois 7-zip.org … Registrar: GoDaddy.com, LLC … $ whois seven.zip … Registrar: Goo

whois isn’t much use any more, but registrar doesn’t match: $ whois 7-zip.org … Registrar: GoDaddy.com, LLC … $ whois seven.zip … Registrar: Google LLC. … Name servers don’t match: $ dig +short 7-zip.org NS ns01.domaincontrol.com. ns02.domaincontrol.com. $ dig +short seven.zip NS ns-cloud-c1.googledomains.com. ns-cloud-c2.googledomains.com. ns-cloud-c3.googledomains.com. ns-cloud-c4.googledomains.com. (Aside: I believe these queries are strictly the wrong thing, asking seven.zip what its nameservers are, but you actually need to ask the zip. nameservers what seven.zip’s nameservers are. The two will normally match, but don’t actually have to, and in my crazy hacker dreams (you know, the ones where five dollar wrenches don’t exist) I can imagine the difference being used sneakily. But I’m not sure if there’s any good way of asking for the actual nameservers with dig, which is basically “`dig +short zip. NS`, then `dig +short @one-of-those-zip-nameserver-addresses seven.zip. NS`”, and yes, you’d need to follow more steps if you were dealing with a deeper domain name. Whois records are actually more convenient in general!) And servers don’t match: $ dig +short 7-zip.org 49.12.202.237 $ dig +short -x 49.12.202.237 static.237.202.12.49.clients.your-server.de. $ dig +short seven.zip 216.239.36.21 216.239.34.21 216.239.32.21 216.239.38.21 $ dig +short -x 216.239.36.21 any-in-2415.1e100.net. These checks give no reason to suspect it’s legitimate.