That vulnerability exists even without .zip domain names, it just makes it a little easier to pull off.