{"id":6761,"date":"2023-05-15T18:25:04","date_gmt":"2023-05-15T16:25:04","guid":{"rendered":"https:\/\/jeffreyappel.nl\/?p=6761"},"modified":"2023-07-27T23:12:12","modified_gmt":"2023-07-27T21:12:12","slug":"block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint","status":"publish","type":"post","link":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/","title":{"rendered":"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint"},"content":{"rendered":"\n<p>Recently there was some news with new gTLD domains. <a href=\"https:\/\/blog.google\/products\/registry\/8-new-top-level-domains-for-dads-grads-tech\/\">Google Registry<\/a> launched eight new top-level domains: .dad,&nbsp;.phd,&nbsp;.prof,&nbsp;.esq,&nbsp;.foo,&nbsp;.zip,&nbsp;.mov,&nbsp;and&nbsp;.nexus.&nbsp;From a security point of view, the .zip and .mov can be dangerous (of course more TLDs are known as malicious targets). Malicious actors can put an index.html which triggers a download for viruses and trojans. Other domains that are heavily used for malicious activity are (.xyz, .click, .rest).  Check <a href=\"https:\/\/www.spamhaus.org\/statistics\/tlds\/\">Spamhaus <\/a>for the top 10 most abused top-level domains.  From my point of view, there is currently no benefit of using one of the new domains. <\/p>\n\n\n\n<p><strong>IMPORTANT update 1-6-2023: The solution seems overall not really stable, in some situations the internet is disconnected for the complete machine. Use the below information during the test. In my test lab, the configuration works perfectly on a couple of machines; where one machine (hosted in Azure) is disconnected completely from the internet. Use the below instruction at your own risk and deploy always to one single test device. Currently investigating why some machines are disconnected completely<\/strong> <strong>and all traffic is blocked. <\/strong><\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong><strong>Blog information:<br><\/strong><br><\/strong>Blog published: May 15, 2023<br>Blog updated: May 30, 2023<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<ul>\n<li>gTLD: Generic top-level domains (.com) <\/li>\n<\/ul>\n\n\n\n<ul>\n<li>FQDNS: Full qualified domain name (Google.com) <\/li>\n<\/ul>\n\n\n\n<p>When we check the recently registered .zip domains it contains a lot of &#8220;potential&#8221; malicious domains including domains like; (already registered) <\/p>\n\n\n\n<ul>\n<li>Microsoft-update(dot)zip<\/li>\n\n\n\n<li>microsoftoutlook(dot)zip<\/li>\n\n\n\n<li>Office365-update(dot)zip<\/li>\n\n\n\n<li>Officeupdate(dot)zip<\/li>\n\n\n\n<li>Software-update(dot)zip<\/li>\n\n\n\n<li>Microsoftdefender(dot)zip<\/li>\n\n\n\n<li>familyphotos(dot)zip<\/li>\n\n\n\n<li>rapid7setup-windows64(dot)zip<\/li>\n\n\n\n<li>sentinelone-installer(dot)zip<\/li>\n<\/ul>\n\n\n\n<p>When the attacker sent the following message: <em>I&#8217;ve attached <strong>familyphotos(dot)zip<\/strong> &#8211; download all photos via the sended link<\/em> &#8211; for most of the users\/regular consumers it is hard to read it is a potential phishing site. Source: <a href=\"https:\/\/twitter.com\/wdormann\/status\/1657397198185693185\">Twitter<\/a><\/p>\n\n\n\n<p>Another issue with the .zip gTLD is that software can automatically attach hyperlinks to ZIP file names in the text. See SANS.edu for more information and a snapshot of .zip domains with functional NS records. Source: <a href=\"https:\/\/isc.sans.edu\/diary\/The+zip+gTLD+Risks+and+Opportunities\/29838\">SANS<\/a><\/p>\n\n\n\n<p>Checked some of the registered domains and already there is some phishing stuff\/ malicious content hosted on the domains.  Microsoft-office(dot)zip is showing a nice Microsoft sign-in page to capture sign-in credentials. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img fetchpriority=\"high\" decoding=\"async\" width=\"1024\" height=\"537\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-41-1024x537.png\" alt=\"\" class=\"wp-image-6772\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-41-1024x537.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-41-300x157.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-41-768x403.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-41-1536x805.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-41-585x307.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-41.png 2047w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>TIP: Defender SmartScreen is detecting the website as potentially malicious. Always recommended to enable Defender SmartScreen. See this <a href=\"https:\/\/jeffreyappel.nl\/microsoft-defender-smartscreen-how-to-use-smartscreen-and-phishing-protection\/\">blog<\/a> for more technical information. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"536\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-42-1024x536.png\" alt=\"\" class=\"wp-image-6773\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-42-1024x536.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-42-300x157.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-42-768x402.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-42-1536x803.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-42-585x306.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-42.png 2034w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Enough information scoped on the potential risk &#8211; let&#8217;s explore how we can block the complete TLD domain using Microsoft technologies and Microsoft Intune. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">How to block gTLD\/ .zip domains<\/h2>\n\n\n\n<p>With the use of Defender for Endpoint there is the option for adding custom indicators. Indicators are not supported for blocking the complete top-level domain (.zip\/ .prof\/ .dad..) and are supported only the block the individual IPs\/ URLs. <\/p>\n\n\n\n<p>In combination with the Windows Firewall component, blocking the gTLDs and FQDNs is possible. Recently Microsoft announced a couple of new management features in Intune for managing the Windows Firewall easier. <\/p>\n\n\n\n<p><strong>Announced recently<\/strong><\/p>\n\n\n\n<p>6 months ago <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/intune-customer-success\/announcing-enhanced-control-for-configuring-firewall-rules-with\/ba-p\/3664744\">Microsoft announced<\/a> the support for Fully Qualified Domain Name (FQDN) rules to block using Windows Defender Firewall and Microsoft Intune. This feature can be used for blocking FQDN rules and gTLD top domains. <\/p>\n\n\n\n<p><strong>Prerequisites<\/strong><\/p>\n\n\n\n<ul>\n<li>Defender Antivirus must be turned on and updated to at least 4.18.2209.7 or later as platform version. <\/li>\n\n\n\n<li>Network Protection needs to be in block or audit mode.  <\/li>\n\n\n\n<li>DNS over HTTPS (DoH) should be disabled<\/li>\n\n\n\n<li>Microsoft Intune (Settings seems currently only available via Intune management)<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Reusable settings in Microsoft Intune<\/h2>\n\n\n\n<p>For blocking FQDN\/ gTLD domains it is recommended to use the new reusable setting feature in Intune. With the new capabilities, it is possible to reuse setting in multiple policies. Admins can create and manage the policy from one single view- that can be reused across multiple policies. The new reusable group feature is currently supported for:<\/p>\n\n\n\n<ul>\n<li>Remote IP address ranges<\/li>\n\n\n\n<li>Fully Qualified Domain Name (FQDN) definition and auto-resolution<\/li>\n<\/ul>\n\n\n\n<p>For configuring reusable go to <strong>Microsoft Intune<\/strong> (Intune.Microsoft.com) -&gt; <strong>Endpoint Security<\/strong> and click <strong>Firewall<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"623\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-33-1024x623.png\" alt=\"\" class=\"wp-image-6762\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-33-1024x623.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-33-300x183.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-33-768x467.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-33-1536x935.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-33-2048x1247.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-33-585x356.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>In the summary blade select the option <strong>Reusable settings <\/strong>and click <strong>Add<\/strong> <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"441\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-34-1024x441.png\" alt=\"\" class=\"wp-image-6763\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-34-1024x441.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-34-300x129.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-34-768x331.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-34-1536x661.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-34-2048x882.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-34-585x252.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When creating the reusable settings it can be attached to more firewall policies, when updating the policies from the reusable settings page it updates all policies automatically. In this case, we can create a policy (Blocklist gTLDs)  and include the &#8220;potential&#8221; malicious gTLDs. <\/p>\n\n\n\n<p>During the configuration, it is important to enable <strong>Auto Resolve <\/strong>to true. When the <strong>Auto Resolve <\/strong>flag is set to true the fully qualified domain name and the addresses will be automatically resolved. This feature works in combination with Defender for Endpoint\/ Sense. Without Sense enrolled this feature is not working. (not documented all it seems MDE is a requirement) <\/p>\n\n\n\n<p>Click on <strong>Edit instance<\/strong> turn on <strong>Auto Resolve <\/strong>and add the domains. Add the domains in the keyword section including wildcard (<strong>*.zip<\/strong>) Do this again for each gTLD or FQDN. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"623\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-35-1024x623.png\" alt=\"\" class=\"wp-image-6764\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-35-1024x623.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-35-300x183.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-35-768x467.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-35-1536x935.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-35-2048x1247.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-35-585x356.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>When all domains are added save the policy. When the reusable setting is created we can re-use the setting in one of the firewall policies\/ or create a new firewall rules policy and deploy the policy to the endpoints. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><strong>New firewall rules policy<\/strong><\/h2>\n\n\n\n<p>In <strong>Intune<\/strong> go to <strong>Endpoint Security &#8211; Firewall<\/strong> and create a <strong>new policy<\/strong>. Select as platform <strong>Windows 10, Windows 11, and Windows Server<\/strong> and profile <strong>Microsoft Defender Firewall Rules. <\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"540\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-38-1024x540.png\" alt=\"\" class=\"wp-image-6768\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-38-1024x540.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-38-300x158.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-38-768x405.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-38-1536x810.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-38-2048x1079.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-38-585x308.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>In the configuration settings of the new profile, we can select the earlier created reusable settings group. <\/p>\n\n\n\n<p>Click <strong>Set reusable settings<\/strong> and choose the earlier created reusable settings for including the setting in the profile. After adding the reusable setting; click <strong>Edit rule. <\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"403\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-40-1024x403.png\" alt=\"\" class=\"wp-image-6770\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-40-1024x403.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-40-300x118.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-40-768x303.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-40-1536x605.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-40-2048x807.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-40-585x231.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><strong>IMPORTANT: Before deploying the profile make sure that the reusable setting is selected and part of the reusable groups. Without selecting\/ adding the profile it will block all traffic. Important to test always the rule on a couple of test machines. When added correctly the reusable groups are visible from the configuration setting page. <\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"362\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-43-1024x362.png\" alt=\"\" class=\"wp-image-6780\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-43-1024x362.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-43-300x106.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-43-768x271.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-43-1536x542.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-43-2048x723.png 2048w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-43-585x207.png 585w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Configure the following settings for blocking the configured domains. The below configuration is scoped to all network interfaces (Wireless, LAN, Mobile Broadband, Remote access) and included all network types (Domain, Private, Public). Define\/ change the policy when needed or target only specific network types\/ interface types when relevant. <\/p>\n\n\n\n<figure class=\"wp-block-table\"><table><tbody><tr><td><strong>Setting<\/strong><\/td><td><strong>Value<\/strong><\/td><\/tr><tr><td>Enabled<\/td><td>Enabled<\/td><\/tr><tr><td>Name<\/td><td>Choose custom name<\/td><\/tr><tr><td>Interface Types<\/td><td>All<\/td><\/tr><tr><td>Edge Traversal<\/td><td>Not configured<\/td><\/tr><tr><td>Network Types<\/td><td>FW_Profile_Type_ALL<\/td><\/tr><tr><td>Direction<\/td><td>The rule applies to outbound traffic<\/td><\/tr><tr><td>Action<\/td><td>Block<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>Deploy the policy to one of the groups. Ideally always testing firewall policies in a smaller scope including test devices before targeting the production channels. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Result<\/h2>\n\n\n\n<p>When the policy is applied the result is a blocked domain. With the use of reusable settings and FQDN\/ TLD blocking there is the option for blocking the complete top-level domain. Using MDE it is always possible to block the full URL (test.zip) instead of the complete domain &#8211; it can be really useful to block the complete top levels domains. From my point of view, there is currently completely no reason why .zip\/ .mov and more are useful for any normal reason. Of course, for malicious reasons they are great. <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"536\" src=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44-1024x536.png\" alt=\"\" class=\"wp-image-6781\" srcset=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44-1024x536.png 1024w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44-300x157.png 300w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44-768x402.png 768w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44-1536x803.png 1536w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44-585x306.png 585w, https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png 2025w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p>Credits to Nathan McNulty <a href=\"https:\/\/twitter.com\/NathanMcNulty\/status\/1657560214294650880\">Twitter.com\/NathanMcNulty<\/a> for bringing attention to the prevention in combination with Windows Defender Firewall on Twitter. <\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Sources<\/h2>\n\n\n\n<p>Microsoft: <a href=\"https:\/\/techcommunity.microsoft.com\/t5\/intune-customer-success\/announcing-enhanced-control-for-configuring-firewall-rules-with\/ba-p\/3664744\">Announcing enhanced control for configuring Firewall rules with Windows Defender<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently there was some news with new gTLD domains. Google Registry launched eight new top-level domains: .dad,&nbsp;.phd,&nbsp;.prof,&nbsp;.esq,&nbsp;.foo,&nbsp;.zip,&nbsp;.mov,&nbsp;and&nbsp;.nexus.&nbsp;From a security point of view, the .zip and .mov can be dangerous (of course more TLDs are known as malicious targets). Malicious actors&#8230;<\/p>\n","protected":false},"author":1,"featured_media":6781,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[189],"tags":[219,193],"table_tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint\" \/>\n<meta property=\"og:description\" content=\"Recently there was some news with new gTLD domains. Google Registry launched eight new top-level domains: .dad,&nbsp;.phd,&nbsp;.prof,&nbsp;.esq,&nbsp;.foo,&nbsp;.zip,&nbsp;.mov,&nbsp;and&nbsp;.nexus.&nbsp;From a security point of view, the .zip and .mov can be dangerous (of course more TLDs are known as malicious targets). Malicious actors...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/\" \/>\n<meta property=\"og:site_name\" content=\"Jeffrey Appel - Microsoft Security blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-05-15T16:25:04+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-07-27T21:12:12+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png\" \/>\n\t<meta property=\"og:image:width\" content=\"2025\" \/>\n\t<meta property=\"og:image:height\" content=\"1059\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Jeffrey\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Jeffrey\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/\",\"url\":\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/\",\"name\":\"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint\",\"isPartOf\":{\"@id\":\"https:\/\/jeffreyappel.nl\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png\",\"datePublished\":\"2023-05-15T16:25:04+00:00\",\"dateModified\":\"2023-07-27T21:12:12+00:00\",\"author\":{\"@id\":\"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42\"},\"breadcrumb\":{\"@id\":\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#primaryimage\",\"url\":\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png\",\"contentUrl\":\"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png\",\"width\":2025,\"height\":1059},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/jeffreyappel.nl\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/jeffreyappel.nl\/#website\",\"url\":\"https:\/\/jeffreyappel.nl\/\",\"name\":\"Jeffrey Appel - Microsoft Security blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/jeffreyappel.nl\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42\",\"name\":\"Jeffrey\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/jeffreyappel.nl\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g\",\"caption\":\"Jeffrey\"},\"url\":\"https:\/\/jeffreyappel.nl\/author\/contact\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/","og_locale":"en_US","og_type":"article","og_title":"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint","og_description":"Recently there was some news with new gTLD domains. Google Registry launched eight new top-level domains: .dad,&nbsp;.phd,&nbsp;.prof,&nbsp;.esq,&nbsp;.foo,&nbsp;.zip,&nbsp;.mov,&nbsp;and&nbsp;.nexus.&nbsp;From a security point of view, the .zip and .mov can be dangerous (of course more TLDs are known as malicious targets). Malicious actors...","og_url":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/","og_site_name":"Jeffrey Appel - Microsoft Security blog","article_published_time":"2023-05-15T16:25:04+00:00","article_modified_time":"2023-07-27T21:12:12+00:00","og_image":[{"width":2025,"height":1059,"url":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png","type":"image\/png"}],"author":"Jeffrey","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Jeffrey","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/","url":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/","name":"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint","isPartOf":{"@id":"https:\/\/jeffreyappel.nl\/#website"},"primaryImageOfPage":{"@id":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#primaryimage"},"image":{"@id":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#primaryimage"},"thumbnailUrl":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png","datePublished":"2023-05-15T16:25:04+00:00","dateModified":"2023-07-27T21:12:12+00:00","author":{"@id":"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42"},"breadcrumb":{"@id":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#primaryimage","url":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png","contentUrl":"https:\/\/jeffreyappel.nl\/wp-content\/uploads\/2023\/05\/image-44.png","width":2025,"height":1059},{"@type":"BreadcrumbList","@id":"https:\/\/jeffreyappel.nl\/block-gtld-zip-fqdn-domains-with-windows-firewall-and-defender-for-endpoint\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/jeffreyappel.nl\/"},{"@type":"ListItem","position":2,"name":"Block gTLD (.zip)\/ FQDN domains with Windows Firewall and Defender for Endpoint"}]},{"@type":"WebSite","@id":"https:\/\/jeffreyappel.nl\/#website","url":"https:\/\/jeffreyappel.nl\/","name":"Jeffrey Appel - Microsoft Security blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/jeffreyappel.nl\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/jeffreyappel.nl\/#\/schema\/person\/ebdd80b67674ad29968ad249abc89c42","name":"Jeffrey","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/jeffreyappel.nl\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/37bbb7acc360ea70a60f26ca4548d940?s=96&d=mm&r=g","caption":"Jeffrey"},"url":"https:\/\/jeffreyappel.nl\/author\/contact\/"}]}},"amp_enabled":false,"_links":{"self":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts\/6761"}],"collection":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/comments?post=6761"}],"version-history":[{"count":21,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts\/6761\/revisions"}],"predecessor-version":[{"id":7179,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/posts\/6761\/revisions\/7179"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/media\/6781"}],"wp:attachment":[{"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/media?parent=6761"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/categories?post=6761"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/tags?post=6761"},{"taxonomy":"table_tags","embeddable":true,"href":"https:\/\/jeffreyappel.nl\/wp-json\/wp\/v2\/table_tags?post=6761"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}