the thing with the .zip controversy is that it probably wouldn't be too hard to get a list of registered domains and do HTTP requests that look like they're coming from gmail and the like, looking for anyone misusing it for spam.
but do I really want to get into the security field? I have tried so hard to avoid it.
.mov too, of course.
although I guess there's always a way around this that the .zip scammers could use:
filename .photos .zip
We can't enumerate the subdomains, and they could always set up their script to only reply on the correct subdomain
