{"id":165,"date":"2025-12-19T09:14:53","date_gmt":"2025-12-19T09:14:53","guid":{"rendered":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/"},"modified":"2025-12-19T09:14:53","modified_gmt":"2025-12-19T09:14:53","slug":"most-parked-domains-now-serving-malicious-content","status":"publish","type":"post","link":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/","title":{"rendered":"Most Parked Domains Now Serving Malicious Content"},"content":{"rendered":"
\n

Direct navigation \u2014 the act of visiting a website by manually typing a domain name in a web browser \u2014 has never been riskier: A new study finds the vast majority of \u201cparked\u201d domains \u2014 mostly expired or dormant domain names, or common misspellings of popular websites \u2014 are now configured to redirect visitors to sites that foist scams and malware.<\/p>\n

\"\"<\/p>\n

A lookalike domain to the FBI Internet Crime Complaint Center website, returned a non-threatening parking page (left) whereas a mobile user was instantly directed to deceptive content in October 2025 (right). Image: Infoblox.<\/p>\n<\/div>\n

When Internet users try to visit expired domain names or accidentally navigate to a lookalike \u201ctyposquatting\u201d domain, they are typically brought to a placeholder page at a domain parking company that tries to monetize the wayward traffic by displaying links to a number of third-party websites that have paid to have their links shown.<\/p>\n

A decade ago, ending up at one of these parked domains came with a relatively small chance of being redirected to a malicious destination: In 2014, researchers found<\/a> (PDF) that parked domains redirected users to malicious sites less than five percent of the time \u2014 regardless of whether the visitor clicked on any links at the parked page.<\/p>\n

But in a series of experiments over the past few months, researchers at the security firm Infoblox<\/strong> say they discovered the situation is now reversed, and that malicious content is by far the norm now for parked websites.<\/p>\n

\u201cIn large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the \u2018click\u2019 was sold from the parking company to advertisers, who often resold that traffic to yet another party,\u201d Infoblox researchers wrote in a paper published today<\/a>.<\/p>\n

Infoblox found parked websites are benign if the visitor arrives at the site using a virtual private network (VPN), or else via a non-residential Internet address. For example, Scotiabank.com<\/strong> customers who accidentally mistype the domain as scotaibank[.]com<\/strong> will see a normal parking page if they\u2019re using a VPN, but will be redirected to a site that tries to foist scams, malware or other unwanted content if coming from a residential IP address. Again, this redirect happens just by visiting the misspelled domain with a mobile device or desktop computer that is using a residential IP address.<\/p>\n

According to Infoblox, the person or entity that owns scotaibank[.]com has a portfolio of nearly 3,000 lookalike domains, including gmai[.]com<\/strong>, which demonstrably has been configured with its own mail server for accepting incoming email messages. Meaning, if you send an email to a Gmail user and accidentally omit the \u201cl\u201d from \u201cgmail.com,\u201d that missive doesn\u2019t just disappear into the ether or produce a bounce reply: It goes straight to these scammers. The report notices this domain also has been leveraged in multiple recent business email compromise campaigns, using a lure indicating a failed payment with trojan malware attached.<\/p>\n

Infoblox found this particular domain holder (betrayed by a common DNS server \u2014 torresdns[.]com) has set up typosquatting domains targeting dozens of top Internet destinations, including Craigslist<\/strong>, YouTube<\/strong>, Google<\/strong>, Wikipedia<\/strong>, Netflix<\/strong>, TripAdvisor<\/strong>, Yahoo<\/strong>, eBay<\/strong>, and Microsoft<\/strong>. A defanged list of these typosquatting domains is available here<\/a> (the dots in the listed domains have been replaced with commas).<\/span><\/p>\n

David Brunsdon<\/strong>, a threat researcher at Infoblox, said the parked pages send visitors through a chain of redirects, all while profiling the visitor\u2019s system using IP geolocation, device fingerprinting, and cookies to determine where to redirect domain visitors.<\/p>\n

\u201cIt was often a chain of redirects \u2014 one or two domains outside the parking company \u2014 before threat arrives,\u201d Brunsdon said. \u201cEach time in the handoff the device is profiled again and again, before being passed off to a malicious domain or else a decoy page like Amazon.com or Alibaba.com if they decide it\u2019s not worth targeting.\u201d<\/p>\n

Brunsdon said domain parking services claim the search results they return on parked pages are designed to be relevant to their parked domains, but that almost none of this displayed content was related to the lookalike domain names they tested.<\/p>\n

\"\"<\/a><\/p>\n

Samples of redirection paths when visiting scotaibank dot com. Each branch includes a series of domains observed, including the color-coded landing page. Image: Infoblox.<\/p>\n<\/div>\n

Infoblox said a different threat actor who owns domaincntrol[.]com<\/strong> \u2014 a domain that differs from GoDaddy\u2019s name servers by a single character \u2014 has long taken advantage of typos in DNS configurations to drive users to malicious websites. In recent months, however, Infoblox discovered the malicious redirect only happens when the query for the misconfigured domain comes from a visitor who is using Cloudflare\u2019s DNS resolvers (1.1.1.1), and that all other visitors will get a page that refuses to load.<\/p>\n

The researchers found that even variations on well-known government domains are being targeted by malicious ad networks.<\/p>\n

\u201cWhen one of our researchers tried to report a crime to the FBI\u2019s Internet Crime Complaint Center<\/strong> (IC3), they accidentally visited ic3[.]org instead of ic3[.]gov,\u201d the report notes. \u201cTheir phone was quickly redirected to a false \u2018Drive Subscription Expired\u2019 page. They were lucky to receive a scam; based on what we\u2019ve learnt, they could just as easily receive an information stealer or trojan malware.\u201d<\/p>\n

The Infoblox report emphasizes that the malicious activity they tracked is not attributed to any known party, noting that the domain parking or advertising platforms named in the study were not implicated in the malvertising they documented.<\/p>\n

However, the report concludes that while the parking companies claim to only work with top advertisers, the traffic to these domains was frequently sold to affiliate networks, who often resold the traffic to the point where the final advertiser had no business relationship with the parking companies.<\/p>\n

Infoblox also pointed out that recent policy changes by Google<\/strong> may have inadvertently increased the risk to users from direct search abuse. Brunsdon said Google Adsense<\/strong> previously defaulted to allowing their ads to be placed on parked pages, but that in early 2025 Google implemented a default setting that had their customers opt-out by default<\/a> on presenting ads on parked domains \u2014 requiring the person running the ad to voluntarily go into their settings and turn on parking as a location.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

Direct navigation \u2014 the act of visiting a website by manually typing a domain name in a web browser \u2014 has never been riskier: A new study finds the vast majority of \u201cparked\u201d domains \u2014 mostly expired or dormant domain names, or common misspellings of popular websites \u2014 are now configured to redirect visitors to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-container-style":"default","site-container-layout":"default","site-sidebar-layout":"default","disable-article-header":"default","disable-site-header":"default","disable-site-footer":"default","disable-content-area-spacing":"default","footnotes":""},"categories":[113,90,201,202,203,46,204,205,206,143,207,145],"tags":[91],"class_list":["post-165","post","type-post","status-publish","format-standard","hentry","category-a-little-sunshine","category-cybersecurity","category-david-brunsdon","category-direct-navigation","category-domain-parking","category-google","category-google-adsense","category-infoblox","category-internet-crime-complaint-center","category-latest-warnings","category-typosquatting","category-web-fraud-2-0","tag-cybersecurity"],"yoast_head":"\nMost Parked Domains Now Serving Malicious Content - Imperative Business Ventures Limited<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Most Parked Domains Now Serving Malicious Content - Imperative Business Ventures Limited\" \/>\n<meta property=\"og:description\" content=\"Direct navigation \u2014 the act of visiting a website by manually typing a domain name in a web browser \u2014 has never been riskier: A new study finds the vast majority of \u201cparked\u201d domains \u2014 mostly expired or dormant domain names, or common misspellings of popular websites \u2014 are now configured to redirect visitors to […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/\" \/>\n<meta property=\"og:site_name\" content=\"Imperative Business Ventures Limited\" \/>\n<meta property=\"article:published_time\" content=\"2025-12-19T09:14:53+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/\"},\"author\":{\"name\":\"admin\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"headline\":\"Most Parked Domains Now Serving Malicious Content\",\"datePublished\":\"2025-12-19T09:14:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/\"},\"wordCount\":1049,\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png\",\"keywords\":[\"Cybersecurity\"],\"articleSection\":[\"A Little Sunshine\",\"Cybersecurity\",\"David Brunsdon\",\"direct navigation\",\"domain parking\",\"Google\",\"Google AdSense\",\"Infoblox\",\"Internet Crime Complaint Center\",\"Latest Warnings\",\"typosquatting\",\"Web Fraud 2.0\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/\",\"url\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/\",\"name\":\"Most Parked Domains Now Serving Malicious Content - Imperative Business Ventures Limited\",\"isPartOf\":{\"@id\":\"https:\/\/blog.ibvl.in\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png\",\"datePublished\":\"2025-12-19T09:14:53+00:00\",\"author\":{\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\"},\"breadcrumb\":{\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage\",\"url\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png\",\"contentUrl\":\"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.ibvl.in\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Most Parked Domains Now Serving Malicious Content\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.ibvl.in\/#website\",\"url\":\"https:\/\/blog.ibvl.in\/\",\"name\":\"Imperative Business Ventures Limited\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.ibvl.in\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/blog.ibvl.in\"],\"url\":\"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Most Parked Domains Now Serving Malicious Content - Imperative Business Ventures Limited","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/","og_locale":"en_US","og_type":"article","og_title":"Most Parked Domains Now Serving Malicious Content - Imperative Business Ventures Limited","og_description":"Direct navigation \u2014 the act of visiting a website by manually typing a domain name in a web browser \u2014 has never been riskier: A new study finds the vast majority of \u201cparked\u201d domains \u2014 mostly expired or dormant domain names, or common misspellings of popular websites \u2014 are now configured to redirect visitors to […]","og_url":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/","og_site_name":"Imperative Business Ventures Limited","article_published_time":"2025-12-19T09:14:53+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#article","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/"},"author":{"name":"admin","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"headline":"Most Parked Domains Now Serving Malicious Content","datePublished":"2025-12-19T09:14:53+00:00","mainEntityOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/"},"wordCount":1049,"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png","keywords":["Cybersecurity"],"articleSection":["A Little Sunshine","Cybersecurity","David Brunsdon","direct navigation","domain parking","Google","Google AdSense","Infoblox","Internet Crime Complaint Center","Latest Warnings","typosquatting","Web Fraud 2.0"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/","url":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/","name":"Most Parked Domains Now Serving Malicious Content - Imperative Business Ventures Limited","isPartOf":{"@id":"https:\/\/blog.ibvl.in\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage"},"image":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage"},"thumbnailUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png","datePublished":"2025-12-19T09:14:53+00:00","author":{"@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02"},"breadcrumb":{"@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#primaryimage","url":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png","contentUrl":"https:\/\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ic3org.png"},{"@type":"BreadcrumbList","@id":"https:\/\/blog.ibvl.in\/index.php\/2025\/12\/19\/most-parked-domains-now-serving-malicious-content\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.ibvl.in\/"},{"@type":"ListItem","position":2,"name":"Most Parked Domains Now Serving Malicious Content"}]},{"@type":"WebSite","@id":"https:\/\/blog.ibvl.in\/#website","url":"https:\/\/blog.ibvl.in\/","name":"Imperative Business Ventures Limited","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.ibvl.in\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/55b87b72a56b1bbe9295fe5ef7a20b02","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.ibvl.in\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4d20b2cd313e4417a599678e950e6fb7d4dfa178a72f2b769335a08aaa615aa9?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/blog.ibvl.in"],"url":"https:\/\/blog.ibvl.in\/index.php\/author\/admin_hcbs9yw6\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/165","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/comments?post=165"}],"version-history":[{"count":0,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/posts\/165\/revisions"}],"wp:attachment":[{"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/media?parent=165"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/categories?post=165"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.ibvl.in\/index.php\/wp-json\/wp\/v2\/tags?post=165"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}