An XSS vulnerability on a dotless domain can lead to XSS on the entire tld. See top level universal XSS[1]
After about 2 minutes of looking, I've just found that nic.io (or just io.) basically lets you type arbitrary html into the search boxes. Chrome's built in XSS auditor catches any scripts you put in there, but (at least) Firefox doesn't.
Check it out:
http://io./cgi-bin/whois?query=%3Ca%20href=%22%22%3E%3Cu%3EA...
If you load it in Firefox (or any browser without an XSS auditor) it'll pop an alert, otherwise you'll just see the image I loaded and a link I inserted.
This is ridiculous.
According to the article, the problem is local to Internet Explorer though.
Essentially, if "intranet" mode is enabled and a website is hosted locally, IE will ignore browser same-origin policy. So a script from http://networkmachine can access all your cookies.
IE hate is very outdated, but the fact that a website hosted locally can have access to all the data the browser stores is mind-boggling. A nondescript dialog is all that stands to protect users.