New Research Reveals 90% of Parked Domains Now Deliver Malware, Scams, and Phishing Attacks

The cybersecurity threat landscape has shifted dramatically, and parked domains have become a primary weapon for delivering malware, scams, and phishing attacks to unsuspecting internet users.

What was once considered a harmless domain monetization practice has transformed into a dangerous attack vector that masks malicious content behind an innocent facade.

Recent research demonstrates that the risks associated with parked domains have grown exponentially over the past decade, fundamentally changing how security professionals must approach domain-based threats.

Parked domains are essentially dormant web addresses without active websites. Traditionally, domain owners monetize these unused properties through parking services that display advertisements to visitors.

However, the introduction of direct search advertising—also known as zero-click parking—has created a sophisticated ecosystem where visitors are automatically redirected based on their device characteristics, location, and browsing behavior.

This feature was designed to deliver relevant content, but has instead become a mechanism for distributing malware and conducting fraud at scale.

The attack begins when users inadvertently visit lookalike domains due to simple typos. A researcher attempting to visit the FBI’s Internet Crime Complaint Center accidentally navigated to ic3[.]org instead of ic3[.]gov, only to be redirected to a fake “Drive Subscription Expired” page.

This scenario represents the tip of the iceberg, as threat actors now deliberately register and weaponize thousands of these domains.

Infoblox analysts identified that malicious content now appears in over 90% of visits to parked domains, compared to less than 5% in previous studies conducted over a decade ago.

The technical infrastructure driving these attacks operates through sophisticated visitor profiling mechanisms.

When users land on a parked domain, they encounter lightweight fingerprinting that collects device information, geolocation data, and browser characteristics. This data determines whether the visitor is redirected to a harmless parking page or to malicious content.

Legitimate security scanners and VPN users typically encounter benign pages. In contrast, real users from residential IP addresses are routed through traffic distribution systems operated by advertising networks, resulting in multiple layers of redirection before reaching malicious content.

Device Fingerprinting and Traffic Distribution

The profiling system collects comprehensive device intelligence through JavaScript execution. This includes screen dimensions, pixel ratios, WebGL capabilities, audio features, storage availability, and network connection details.

One affiliate of the ExplorAds advertising platform implemented a sophisticated fingerprinting script containing Russian-language comments that sent base64-encoded device data to its traffic distribution system.

This level of technical sophistication reveals a professionally managed operation rather than random abuse. Three major domain portfolio holders now operate these malicious ecosystems.

One actor controls nearly 3,000 lookalike domains via dedicated name servers, including Gmail.com, a Gmail typosquat that is actively used in phishing campaigns with Trojan malware attachments.

Another uses double fast-flux techniques with rotating name servers, such as koaladns[.]com and quokkadns[.]com.

A third party owns domaincntrol[.]com, which differs from GoDaddy’s legitimate domaincntrol[.]com by a single letter and targets over 30,000 misconfigured domains.

The convergence of generative AI, expired-domain takeovers, and deliberately registered typosquats has created an ecosystem in which criminals profit from simple user mistakes. At the same time, security teams struggle to attribute and block these threats.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.