Direct navigation — the act of visiting an internet site by manually typing a website identify in an internet browser — has by no means been riskier: A brand new research finds the overwhelming majority of “parked” domains — principally expired or dormant domains, or frequent misspellings of common web sites — at the moment are configured to redirect guests to websites that foist scams and malware.
A lookalike area to the FBI Web Crime Grievance Heart web site, returned a non-threatening parking web page (left) whereas a cellular consumer was immediately directed to misleading content material in October 2025 (proper). Picture: Infoblox.
When Web customers attempt to go to expired domains or by chance navigate to a lookalike “typosquatting” area, they’re sometimes delivered to a placeholder web page at a website parking firm that tries to monetize the wayward visitors by displaying hyperlinks to quite a lot of third-party web sites which have paid to have their hyperlinks proven.
A decade in the past, ending up at one among these parked domains got here with a comparatively small likelihood of being redirected to a malicious vacation spot: In 2014, researchers discovered (PDF) that parked domains redirected customers to malicious websites lower than 5 p.c of the time — no matter whether or not the customer clicked on any hyperlinks on the parked web page.
However in a sequence of experiments over the previous few months, researchers on the safety agency Infoblox say they found the scenario is now reversed, and that malicious content material is by far the norm now for parked web sites.
“In giant scale experiments, we discovered that over 90% of the time, guests to a parked area could be directed to unlawful content material, scams, scareware and anti-virus software program subscriptions, or malware, because the ‘click on’ was bought from the parking firm to advertisers, who usually resold that visitors to yet one more get together,” Infoblox researchers wrote in a paper printed as we speak.
Infoblox discovered parked web sites are benign if the customer arrives on the web site utilizing a digital non-public community (VPN), or else by way of a non-residential Web tackle. For instance, Scotiabank.com clients who by chance mistype the area as scotaibank[.]com will see a traditional parking web page in the event that they’re utilizing a VPN, however will likely be redirected to a web site that tries to foist scams, malware or different undesirable content material if coming from a residential IP tackle. Once more, this redirect occurs simply by visiting the misspelled area with a cellular machine or desktop laptop that’s utilizing a residential IP tackle.
In response to Infoblox, the individual or entity that owns scotaibank[.]com has a portfolio of almost 3,000 lookalike domains, together with gmai[.]com, which demonstrably has been configured with its personal mail server for accepting incoming e-mail messages. Which means, in the event you ship an e-mail to a Gmail consumer and by chance omit the “l” from “gmail.com,” that missive doesn’t simply disappear into the ether or produce a bounce reply: It goes straight to those scammers. The report notices this area additionally has been leveraged in a number of current enterprise e-mail compromise campaigns, utilizing a lure indicating a failed cost with trojan malware connected.
Infoblox discovered this specific area holder (betrayed by a typical DNS server — torresdns[.]com) has arrange typosquatting domains focusing on dozens of high Web locations, together with Craigslist, YouTube, Google, Wikipedia, Netflix, TripAdvisor, Yahoo, eBay, and Microsoft. A defanged checklist of those typosquatting domains is accessible right here (the dots within the listed domains have been changed with commas).
David Brunsdon, a risk researcher at Infoblox, mentioned the parked pages ship guests by way of a sequence of redirects, all whereas profiling the customer’s system utilizing IP geolocation, machine fingerprinting, and cookies to find out the place to redirect area guests.
“It was usually a sequence of redirects — one or two domains exterior the parking firm — earlier than risk arrives,” Brunsdon mentioned. “Every time within the handoff the machine is profiled repeatedly, earlier than being handed off to a malicious area or else a decoy web page like Amazon.com or Alibaba.com in the event that they resolve it’s not value focusing on.”
Brunsdon mentioned area parking providers declare the search outcomes they return on parked pages are designed to be related to their parked domains, however that nearly none of this displayed content material was associated to the lookalike domains they examined.
Samples of redirection paths when visiting scotaibank dot com. Every department features a sequence of domains noticed, together with the color-coded touchdown web page. Picture: Infoblox.
Infoblox mentioned a special risk actor who owns domaincntrol[.]com — a website that differs from GoDaddy’s identify servers by a single character — has lengthy taken benefit of typos in DNS configurations to drive customers to malicious web sites. In current months, nevertheless, Infoblox found the malicious redirect solely occurs when the question for the misconfigured area comes from a customer who’s utilizing Cloudflare’s DNS resolvers (1.1.1.1), and that every one different guests will get a web page that refuses to load.
The researchers discovered that even variations on well-known authorities domains are being focused by malicious advert networks.
“When one among our researchers tried to report a criminal offense to the FBI’s Web Crime Grievance Heart (IC3), they by chance visited ic3[.]org as a substitute of ic3[.]gov,” the report notes. “Their cellphone was rapidly redirected to a false ‘Drive Subscription Expired’ web page. They have been fortunate to obtain a rip-off; based mostly on what we’ve learnt, they may simply as simply obtain an data stealer or trojan malware.”
The Infoblox report emphasizes that the malicious exercise they tracked will not be attributed to any recognized get together, noting that the area parking or promoting platforms named within the research weren’t implicated within the malvertising they documented.
Nonetheless, the report concludes that whereas the parking firms declare to solely work with high advertisers, the visitors to those domains was ceaselessly bought to affiliate networks, who usually resold the visitors to the purpose the place the ultimate advertiser had no enterprise relationship with the parking firms.
Infoblox additionally identified that current coverage adjustments by Google might have inadvertently elevated the danger to customers from direct search abuse. Brunsdon mentioned Google Adsense beforehand defaulted to permitting their advertisements to be positioned on parked pages, however that in early 2025 Google carried out a default setting that had their clients opt-out by default on presenting advertisements on parked domains — requiring the individual operating the advert to voluntarily go into their settings and activate parking as a location.
