Most parked domains now redirect visitors to scams, malware and fake security warnings
New Infoblox research finds that over 90% of parked domains now redirect users—often immediately—to scams, malware or fake security warnings, a dramatic jump from under 5% in 2014 that stems from post‑March 2025 monetization changes.
- More than 90% of parked domains now send visitors to malicious content, according to KrebsOnSecurity reporting on Infoblox.
- The risk rose from under 5% in 2014 to over 90% now, driven by new parking monetization models after Google’s March 2025 policy change.
- Typosquatting and zero‑click redirects mean a single mistyped address (for example, gmai[.]com) can expose devices to malware or scareware.
What are parked domains — and why the shift?
Parked domains are web addresses not actively used: expired sites, investment names, and common misspellings. Traditionally monetized through major ad networks, many owners shifted after Google’s March 2025 policy to require explicit opt-ins for parked traffic. That change pushed owners toward direct search and zero‑click parking, where traffic is auctioned and resold to affiliate networks that can funnel visitors into scams and malware. Reporting explains how these new models allow less oversight and greater abuse, and how networks and exchanges profit from reselling visits to risky operators.
For deeper reading on the shift, see KrebsOnSecurity and CyberPress.
How the attacks work
Many parked domains operate as instant redirectors: a mistyped address can send a user through hidden domains to landing pages that host phishing, scams, or fake security warnings that pressure installation of malicious software. These redirects can occur without any click — simply loading the parked address is enough.
“Operators use IP geolocation, device fingerprinting, cookies and user‑agent strings to target residential users while cloaking activity from scanners and VPNs.”
To avoid detection, bad actors cloak behavior (serving benign pages to scanners, VPNs or researchers) and selectively deliver harmful content to real users on home networks. See coverage by KrebsOnSecurity and CyberPress.
Typosquatting threat: single keystrokes can cause big harm
Typosquatting — registering small misspellings of major sites (for example, scotaibank[.]com to imitate Scotiabank or domaincntrol[.]com to mimic GoDaddy) — is central to this trend. Attackers park these lookalike domains in systems that funnel traffic into scams. Infoblox and industry reporting warn that malicious parked domains now make up the bulk of typosquatting attacks.
Further context is available from CyberPress and PC Matic.
Who is behind it and how big is the problem?
Researchers have identified operators and networks managing thousands of lookalike domains. Examples include operators tied to roughly 3,000 domains (reporting names a group around torresdns[.]com) and other actors who rotate name servers and IP addresses to evade blocklists. The ecosystem mixes legitimate ad systems with low‑quality traffic exchanges and affiliate networks such as Zeropark and Trillion Direct Search, increasing resilience and complicating takedowns.
Why these redirects are hard to spot
Cloaking allows malicious behavior to remain hidden from automated scans. Operators detect visitors from known labs, VPNs or researchers and serve benign pages in those cases, while exposing real users to harmful content. This selective targeting helps scams and malware persist on parked domains long after simple scans would suggest a site is safe.
See reporting at KrebsOnSecurity and analysis at CybersecurityNews.
Practical ways to stay safe
- Use bookmarks for important sites (banking, email, municipal services) to avoid typosquatting traps. Source: KrebsOnSecurity.
- Double‑check URLs before pressing Enter — watch for misspellings, extra characters or wrong endings. Source: CyberPress.
- Install and update antivirus/endpoint protection to block known malware and flag scareware. Source: KrebsOnSecurity.
- Minimize sensitive data stored locally and keep browsers/devices patched. Sources: Fox News Tech.
- Be wary of scare tactics — do not call numbers shown in unexpected pop-ups or download software pushed by sudden warnings. Source: KrebsOnSecurity.
- Consider a VPN to mask residential IPs (note: cloaking systems may serve different content to VPN users). Sources: CyberPress and CybersecurityNews.
Sources and further reading
- KrebsOnSecurity — Most Parked Domains Now Serving Malicious Content
- CyberPress — Parked Domains: Malware, Scams and the Zero-Click Problem
- PC Matic — The Dormant Domain Threat Evolves
- CybersecurityNews — New Research Reveals 90% of Parked Domains Are Malicious
- KBI Media — The Secret Life of Parked Domains
- Fox News Tech — Most parked domains now push scams, malware
Implications for San Luis Obispo, California
Economic impact: Local small businesses that rely on web traffic risk losing customers who mistype addresses and land on scam pages. Variants of local domains can be sold or abused, affecting bookings, revenue and trust.
Political consequences: Mistyped municipal pages could expose residents to phishing or fake alerts, increasing pressure on city IT teams to monitor registrations and inform the public.
Social effects: SLO County’s mix of remote workers, students and older residents could see infections spread via shared machines and backups; scareware targeting older adults can be financially harmful.
Cultural relevance: As a tourism and small‑business community, San Luis Obispo may see eroded confidence in local digital services; community education aligns with local values of neighborly protection.
Practical applications for residents
- Bookmark important services (city, banks, local businesses) to avoid typos.
- Share a short checklist: check URLs, update browsers, run antivirus scans, and never call numbers shown in unexpected pop-ups.
- If you run a business, register likely misspellings of your domain and consider domain monitoring services.
- Libraries, schools and the county public information office can host workshops and distribute handouts on spotting parked‑domain traps.
If you suspect a compromise: disconnect from the internet, run a known antivirus scan, and contact trusted tech support or your bank if financial information may have been exposed. Sources: KrebsOnSecurity and CyberPress.
What’s next
Further reporting will track how domain marketplaces, ad networks and regulators respond to the rising use of parked domains for fraud and malware. For ongoing updates, consult the sources listed above and apply the practical safety steps immediately.
