Threat actors add .zip domains to their phishing arsenals :