Most Parked Domains Now Serving Malicious Content (krebsonsecurity.com)
- Reference: 0180418969
- News link: https://tech.slashdot.org/story/25/12/18/220216/most-parked-domains-now-serving-malicious-content
- Source link: https://krebsonsecurity.com/2025/12/most-parked-domains-now-serving-malicious-content/
> Direct navigation -- the act of visiting a website by manually typing a domain name in a web browser -- has never been riskier: A new study finds the vast majority of "parked" domains -- mostly expired or dormant domain names, or common misspellings of popular websites -- are [1]now configured to redirect visitors to sites that foist scams and malware . When Internet users try to visit expired domain names or accidentally navigate to a lookalike "typosquatting" domain, they are typically brought to a placeholder page at a domain parking company that tries to monetize the wayward traffic by displaying links to a number of third-party websites that have paid to have their links shown.
>
> A decade ago, ending up at one of these parked domains came with a relatively small chance of being redirected to a malicious destination: In 2014, researchers [2]found (PDF) that parked domains redirected users to malicious sites less than five percent of the time -- regardless of whether the visitor clicked on any links at the parked page. But in a series of experiments over the past few months, researchers at the security firm Infoblox say they discovered the situation is now reversed, and that malicious content is by far the norm now for parked websites.
"In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the 'click' was sold from the parking company to advertisers, who often resold that traffic to yet another party," Infoblox researchers wrote in [3]a paper published today .
[1] https://krebsonsecurity.com/2025/12/most-parked-domains-now-serving-malicious-content/
[2] https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-alrwais.pdf
[3] https://blogs.infoblox.com/threat-intelligence/parked-domains-become-weapons-with-direct-search-advertising/
how'd it take this long? (Score:3)
What shocks me here is how long it took to become such a popular thing? Parking domains isn't that expensive, but certainly isn't free, especially in large numbers. The people doing the parking are basically squatting on property they speculate will have value down the road. They may as well collect a little "rent" on them while they squat?
I can remember when "domain tasting" first became a thing, I looked at it and thought, "This is a TERRIBLE idea, it's going to make it more expensive for people to start up their own web site and 'interesting' domains are going to be unobtainable by the average person just because some squatter thinks they're parked on gold." No random person is going to pay thousands of dollars for a domain name they fancy just for a hobby, so it's just going to stifle small private sites.
I don't know how it currently works, but back when it started you could "taste" a domain for months almost for free, and there was nothing stopping you from "tasting" it again the instant your current taste expired, So you could squat domains for an unlimited time almost for free. "gee, nobody would ever abuse that!"
Though now with the explosion of TLDs, it's widened the market so far that the squatters are finding it hard to cover all the bases. Raise their rent! (and make the price go up exponentially to KEEP it parked) Watch the squatters scurry away like the cockroaches they are!
Happened to me yesterday (Score:2)
I accidentally misspelled Slashdot and got redirected to a "you're infected" page.
Internet advertising meets malware (Score:2)
You will never find a more wretched hive of scum and villainy. We must be cautious.
Root of the problem (Score:1)
Its people typing in domains, and going to random websites, yeah that's the problem! /sarc. More like its that the world wide web has become a transfer of executables, such that you can basically run an OS [1]https://www.windows93.net/ [windows93.net] just think of the possibilities of running that level of code over just a basic document like how things used to be
[1] https://www.windows93.net/
Re: (Score:2)
Agreed. What's needed is a way to do essentially the same thing as AJAX without any client JS. There would be more latency with the processing happening on the server side, but that's an acceptable tradeoff for many purposes where it doesn't matter much.
My research supports their conclusions (Score:5, Interesting)
I've been looking at domains for 20+ years, and have a database with information on several hundred million of them. (1) Typosquatting is epidemic. (2) I see no signs that anyone -- not ICANN, not registrars, not web hosts -- is even attempting to do anything about it. (3) Registrar bulk pricing structures are clearly geared to cater to this market. (4) Registrar practices strongly encourage registrants to burn through domains as rapidly as possible -- that is, to use them for fraud or malware or phishing or whatever, then discard them, leaving them permanently unusable for everyone. (5) A conservative estimate of the fraction of extant junk domains -- where "junk" includes typosquatting, fraud, phishing, malware distribution, etc. -- is 90%. A realistic estimate is 95%. And I wouldn't disagree if someone advanced an estimate of 99% -- I think that's a bit high, but it's certainly plausible.
It's really that bad. And it's going to stay that bad, because everyone involved -- ICANN, registrars, hosts -- is making a fortune off this.
Defending against this is difficult, but one useful tactic is to use DNS RPZ to block resolution of entire TLDs, e.g., .xyz -- and to make point exceptions if/when they become necessary. I recommend doing this for all of the recent gTLDs, because they're completely overrun. I also recommend doing it for any newly-announced gTLDs, because they will be the same, shortly after launch: there's no point in waiting.
Re: (Score:2)
Pretty much any DNS filtering software can block parked and newly-registered domains.
Though we shouldn't have to. Companies like GoDaddy need to get up off their asses.
Re: (Score:2)
> Companies like GoDaddy need to get up off their asses.
Companies like GoDaddy got up off their asses and sold domains as they were permitted to do. They aren't required to do any diligence beyond recording ostensible contact information which they aren't required to verify.
Indeed. Look at sun.com (Score:5, Funny)
Takes you to Oracle!
Re: (Score:2)
oracle acquired sun ages ago...
Re: (Score:2)
Whoooosssh....
scum all day (Score:5, Insightful)
A lot of people think that social networks are the lowest form of shit on the internet, but in fact it's domain squatters. The practice should be illegal, punishable by both fines and being forced to sell the domain in an open auction for whatever the market will bear or relinquish it without recompense within 30 days.
Re: (Score:3)
> So you're just going to seize somebody's because you've decided that you don't like how they're using it?
No, they're going to sell it to the highest bidder. You're going to need a tune-up on your translation software, Ivan.
Re:scum all day (Score:4, Informative)
No, they're going to seize a domain because it's being used *to commit a crime*. That's a big difference.
Re: (Score:2)
At the very least, being an attractive nuisance, where even if the initial ad placement is legal, it serves illegal content enough to be a problem.
Re: (Score:3)
If you're selling (or just giving away) copyrighted content, they will seize your domain, and then go about trying to sue or arrest you.
So it's just who did you offend. You and me, getting malware because we tried an old site? Feh, as if they care. Sports league, yeah, we gonna hunt you. Movie studio, cut your Internet access off, suer you for billions, can we put you in jail?
It's just who you offend. And it's not just about the Internet...
Re: (Score:2)
Actually, it's domain registrars who 'park' domains and sell the access to scum.
Re: (Score:2)
> Actually, it's domain registrars who 'park' domains and sell the access to scum.
ACKTUALLY they are far from the only offenders.
Re: (Score:2)
Being one of many does not make you less guilty.
Re: (Score:2)
> Being one of many does not make you less guilty.
What it does is make your statement false and reveal your ignorance.
Re: scum all day (Score:2)
And I live rent free in your head. Honestly, is that all there is for you?
Re: (Score:2)
It's amazing how enthusiastically you miss the point over and over again. It's almost like you're stupid.