Happy #ICANN Reveal Fresh Hell Day!

[Gæst]

@badsamurai All these extra TLDs is a scam enabling scamming.

[badsamurai@infosec.exchange]

@mttaggart But no one was really paying attention when CRR (Google) acquired .zip and .mov in 2013.

This round we're going to file those objections (string confusion).

No filenames, no intranet names, no assumed trust names.

So I hope these orgs enjoyed their $227,000 donation to ICANN.

https://newgtlds.icann.org/en/program-status/odr#objection-dispute-resolution

[pberry@me.dm]

@badsamurai so… https://pdf.pdf/pdf.pdf could be a legit url

[svavar@masto.svavar.com]

@pberry @badsamurai

This is not a new thing.

https://md.md/md.md has been valid for decades.

https://readme.md is run by some AI slop directory.

[pberry@me.dm]

@svavar @badsamurai yeah, but pdf is way funnier than md

[badsamurai@infosec.exchange]

@svavar @pberry

Correct, .md is a ccTLD that's been around longer than markdown. But this is 2026 and these domains have an extremely high likelihood for abuse in phishing, clickfix, and supply chain attacks. ICANN allowing these would be irresponsible.

Once these are approved, there will be no oversight. .duo was applied for by ShortDot, a notorious bulletproof operator known for some of the most abused TLDs on the internet today: .bond .sbs .icu and .cyou

[mustardfacial@infosec.exchange]

@badsamurai not gonna lie, I kinda hope this one passes

Also the amount of numbered companies in this list is fucking staggering

[luja@chaos.social]

@badsamurai
.alder
.bruder

[badsamurai@infosec.exchange]

@Mustardfacial I am not at all worried typo squatting on .fart

And some solid future fedi server TLDs! .furry .meow .uwu .slay .neko

[gsuberland@chaos.social]

@badsamurai the IETF could do something very funny right now: publish an RFC that preemptively reserves the abusable ones.

[somebody@circumstances.run]

@badsamurai oh come tf on

[jcm@wafrn.jcm.re]

@badsamurai@infosec.exchange

RFC 8369 would fix DNS, just saying

[gbargoud@masto.nyc]

@badsamurai @mttaggart

I did want someone to get .gif and .jpg so when someone comments "thatsthejoke.gif" or "surprisedpikachu.jpg" it could point to the appropriate one. Kind of like a URI for commonly used memes. It's definitely worth the security issues.

[riverpunk@defcon.social]

@badsamurai if submissions of this kind are likely to be rejected, it seems the red teamer's approach is simple -- pick pre-existing TLDs, and introduce them as file extensions for important file types!

Let's invent a new kind of .ai file, or a .net file (a file that connects you to the internet, maybe?)

(Of course, if you're a reasonable human being, this all is actually a terrible idea)

[yuki@im-in.space]

@badsamurai I'd imagine Adobe would definitely object to this, as well as PHP also objecting to .php

[svavar@masto.svavar.com]

@riverpunk @badsamurai

.com used to be for DOS executables.

https://command.com/ is a home hardware company.

Not sure why this is a problem now all of a sudden.

[netzblockierer@tech.lgbt]

@badsamurai kinda like .zip is being blocked by many corporate firewalls.

[badsamurai@infosec.exchange]

I missed .lan, .corp and .mail were also submitted. Corp and mail were originally rejected by ICANN in 2012 as thought too dangerous. Somehow 2026 is safer?

.pdf and .php are technically backup choices, but still an absurd submissions. As is .csr and .bin.

The inherent trust words have their own issues: .login .auth .account .admin .official .verified. I don't see how these are anything but a ransom against organizations to preempt squatting.

[viss@mastodon.social]

@badsamurai see i WOULDA said these would be fantastic redteaming domains, but since ai kinda killed redteaming, its now just prompt fodder for various prompt injection attacks and phishing shits

[netzblockierer@tech.lgbt]

@gsuberland @badsamurai yes, like .example or .local are…