Majority of Parked Domains Redirect to Malicious Content
Summary
Hide ▲
Show ▼
A new study by Infoblox reveals that over 90% of parked domains now redirect visitors to malicious content, including scams, malware, and phishing sites. This shift represents a significant increase from a decade ago, when such redirects were rare. The malicious redirects primarily target users accessing these domains from residential IP addresses, while VPN users or non-residential IPs see benign parking pages. The study also identified a specific domain holder using typosquatting domains to target major websites and services, including Gmail, YouTube, and government sites like the FBI's IC3.
Timeline
-
16.12.2025 16:14 1 articles · 3h ago
Infoblox Study Reveals Over 90% of Parked Domains Redirect to Malicious Content
A new study by Infoblox found that over 90% of parked domains now redirect visitors to malicious content, including scams, malware, and phishing sites. The study also identified a specific domain holder using typosquatting domains to target major websites and services, including Gmail, YouTube, and government sites like the FBI's IC3. The malicious redirects primarily target users accessing these domains from residential IP addresses, while VPN users or non-residential IPs see benign parking pages.
Show sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
Information Snippets
-
Over 90% of parked domains now redirect visitors to malicious content, including scams, malware, and phishing sites.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
-
Malicious redirects primarily target users accessing parked domains from residential IP addresses.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
-
VPN users or those accessing from non-residential IPs see benign parking pages.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
-
A specific domain holder uses typosquatting domains to target major websites and services, including Gmail, YouTube, and government sites.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
-
The malicious redirects involve a chain of redirects and profiling of the visitor's system using IP geolocation, device fingerprinting, and cookies.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
-
The domain parking services claim their search results are relevant to the parked domains, but the content displayed is often unrelated.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
-
A different threat actor exploits typos in DNS configurations to drive users to malicious websites, particularly when using Cloudflare’s DNS resolvers.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14
-
The malicious activity is not attributed to any known party, and the domain parking or advertising platforms named in the study were not implicated in the malvertising.
First reported: 16.12.2025 16:141 source, 1 articleShow sources
- Most Parked Domains Now Serving Malicious Content — krebsonsecurity.com — 16.12.2025 16:14