Parked Domains Emerge as a Primary Channel for Malware and Phishing

The domain parking landscape has significantly evolved over the past decade, transitioning from a benign monetization strategy to a complex vector for cybercrime. Recent research indicates that over 90% of visitors to parked domains now encounter malicious content, scams, or phishing attacks, compared to less than 5% eleven years ago.

Parked domains, once viewed as simple advertising platforms, are now exploited by threat actors using a network of domain owners, traffic distribution systems, and advertising networks. This shift is driven by both cybercriminal activity and vulnerabilities within legitimate business practices in the parking industry.

The threat involves lookalike domains and common typographical errors. For instance, mistyping ic3.org instead of ic3.gov, the FBI's Internet Crime Complaint Center, can lead to fraudulent scam pages. Such domains may also deliver malware under different conditions.

Parked domains exhibit dual behavior: appearing harmless to security tools or VPN services, while delivering malicious content to residential IP addresses through traffic distribution systems controlled by threat actors.

The monetization model known as "direct search" or "zero-click parking" plays a central role in this threat ecosystem. Domain owners engage in systems where traffic is sold to advertisers via real-time bidding, akin to legitimate advertising exchanges.

Users entering a domain name are redirected through several intermediaries that perform device fingerprinting and profiling before reaching a landing page. This system creates a profitable supply chain for malicious actors, with domains passing through multiple advertising networks, adding complexity and obscuring accountability.

Research has identified three significant actors operating large-scale domain portfolios targeting different demographics with lookalike domains. One actor manages nearly three thousand lookalike domains through custom name servers, while another employs "double fast flux" techniques, rotating both name servers and IP addresses to evade detection. The third actor uses domaincntrol.com, exploiting typographical errors in DNS configurations.

Google's recent policy changes requiring advertisers to opt into parking traffic have inadvertently driven domain investors toward direct search parking models. As traditional advertising revenue declines, parking platforms promote direct search as an alternative revenue source, potentially increasing user exposure to malicious content.

Domain portfolio owners participate in user profiling and selective traffic routing, contributing to the threat landscape. As direct search parking adoption increases, the risk to internet users also rises, making simple typing errors potentially catastrophic.

Addressing this threat requires enhanced transparency throughout the parking ecosystem and coordinated actions from platform operators, domain registrars, and security researchers.

Based on reporting by GBHackers.