{"id":12679,"date":"2025-12-16T05:55:43","date_gmt":"2025-12-16T13:55:43","guid":{"rendered":"https:\/\/blogs.infoblox.com\/?p=12679"},"modified":"2025-12-19T04:24:56","modified_gmt":"2025-12-19T12:24:56","slug":"parked-domains-become-weapons-with-direct-search-advertising","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/threat-intelligence\/parked-domains-become-weapons-with-direct-search-advertising\/","title":{"rendered":"Parked Domains Become Weapons with Direct Search Advertising"},"content":{"rendered":"

Executive Summary<\/h3>\n

Just how dangerous is a parked domain? A lot more than you might think. Defenders often associate parked domains with bland pages filled with search advertisements, leading many to conclude they are harmless. But the landscape has changed. Increasingly, the user is led directly to an \u201cadvertisement.\u201d We use quotes here because an extensive investigation into the modern parking ecosystem found that the landing page was malicious more often than not. But it\u2019s not just malicious advertisers that make parked domains risky; threat actors operating within the complex ecosystem abuse it in ways that make crime easy and attribution difficult. We\u2019ve spent the last several months trying to untangle it. Along the way, we found actors pulling DNS shenanigans. This report describes why parking has become more dangerous and details three previously unpublished actors who play an underreported role in the threat landscape.<\/p>\n

Parking threats are fueled by lookalike domains. No domain is immune. When one of our researchers tried to report a crime to the FBI\u2019s Internet Crime Complaint Center (IC3), they accidentally visited ic3[.]org instead of ic3[.]gov. Their phone was quickly redirected to a false \u201cDrive Subscription Expired\u201d page. They were lucky to receive a scam; based on what we\u2019ve learnt, they could just as easily receive an information stealer or trojan malware. The real threat from parked domains comes from their ability to hide malicious activity. If we visit that same domain from a website scanner, it delivers a stereotypical parking page, leading people and automated systems to believe it is harmless. See Figure 1. See a recording of how the same domain delivers different threats here<\/strong><\/a>.<\/p>\n

\n\"Figure
\n\"Figure\n<\/div>\n

Figure 1. A scan<\/strong><\/a> of ic3[.]org, a lookalike to the FBI Internet Crime Complaint Center website, returned a non-threatening parking page (left) whereas a mobile user was instantly directed to deceptive content in October 2025 (right).<\/p>\n

At the heart of the matter is a feature referred to as direct search<\/strong><\/a> or zero click parking<\/strong><\/a>, which is intended to directly deliver users relevant content based on the parked domain name. When a domain owner opts into direct search, traffic to the domain is sold to advertisers who bid on keywords and traffic characteristics. In practice, the site visitor is usually funneled through a series of traffic distribution systems (TDSs) operated by third-party advertising platforms, creating a complex web where a legitimate business model is weaponized for abuse.<\/p>\n

The likelihood of encountering malicious content has risen dramatically since a major study was published<\/strong><\/a> over a decade ago. Those researchers, although alarmed by the potential risks, estimated that malicious content was delivered less than 5% of the time via parked domains. We\u2019ve found that the situation is now reversed: malicious content is the norm. Aside from incidental typos, unscrupulous parties purchase formerly legitimate domains or lookalike domains and drive victims to them. Additionally, the rapid proliferation of generative AI tools plays a role in this threat landscape. AI chat systems incorporate internet history into their training models and can include outdated URLs in their answers. When these domains are picked up by bad actors, the seemingly trustworthy AI link can lead users to malicious content<\/strong><\/a>.<\/p>\n

In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the \u201cclick\u201d was sold from the parking company to advertisers, who often resold that traffic to yet another party. None of this displayed content was related to the domain name we visited.<\/p>\n

The details of the parking threat ecosystem are complex, so to illustrate the risks we will primarily examine a single domain: <redacted>[.]com, a typosquat of the legitimate domain for a large financial institution. Through this example, we\u2019ll demonstrate how accidental typos, or lookalike domains, deliberately placed by cybercriminals can lead to a variety of threats.<\/p>\n

<redacted>[.]com is part of a domain portfolio full of lookalikes to major brands, who own some of the most popular sites on the internet. These lookalike domains are not directly parked with a major company. Instead, an intermediary server operates as a simple TDS and will redirect to a standard parking page if the visitor is not from a residential IP address. Otherwise, the domain controller will redirect to one of a few parking companies where even more sophisticated user fingerprinting occurs before the landing page is displayed.<\/p>\n

We studied parking platforms, domain portfolio owners, publishers, and advertising networks for their role in delivering malvertising to end users. Sketchy players, along with abused entities, exist in every part of the ecosystem. While the scam or malware comes from the advertiser, we found domain portfolio holders often engage in suspicious practices and are an underreported element of the threat landscape. In this paper, we detail how:<\/p>\n