Most parked domains now serving malicious content

(krebsonsecurity.com)

59 points | by bookofjoe 2 hours ago

7 comments

  • belorn 3 minutes ago
    Their definition of parked domain is a bit odd, with "expired" domain names and typosquatting” domains. I work at a registrar and the absolutely vast majority of parked domains are domains owned by customers that register alternative versions, campaign, products and misspellings of their primary domain. Parked in that sense mean an almost empty zone with occasionally a default landing page, sometimes as a paid DNS service at the registrant, and sometimes as a free service (you still got the pay the registration and renewal fees).

    Putting a redirect onto such domain would be a major bad faith act by the registrar and a reason to avoid that registrar at all costs. The customer is the owner of that name, has their name attached as the registrant, and generally hold some legal risk while doing so. It also goes directly against the primary reason why the customers bought the domains in the first place.

    The ones that hold advertisement are generally two specific cases. One is "expired" domains which are not actually expired but where the registrar holds on to it in the hope that the old or new customer will buy it for an extra cost. The other is names which a customer or the registrar itself bought as an investment in hope to auction out. That kind of behavior was historically frowned at but is fairly common practice for a smaller number of domains. Usually you don't put redirects on those since you want to expose the fact that the domain is for sale.

    So I am very confused where they got their 90% number from.

  • ericpauley 1 hour ago
    We did a large-scale study of this phenomenon recently: https://www.cs.bu.edu/faculty/crovella/paper-archive/wung-if...

    Across a broad sample of typo domains of major sites, most registered domains aren’t actually reachable, implying they are registered for defensive, legitimate, or unrelated purposes. Interestingly, the typo space on major sites is actually very sparsely registered (2% at edit distance 1), meaning that typosquatting may actually be underexploited.

  • Bender 1 hour ago
    I park mine by having no IP address, MX record is "0 ." meaning it does not receive email, the SPF record is "v=spf1 -all" and DMARC is a strict reject, CAA is 0 issue ";", BIMI is "v=BIMI1; l=; a=;". I do the same for wildcard DNS. There's probably more I should add.
    • ericpauley 1 hour ago
      Indeed, this is a common practice in the broader data. It seems the linked article is filtering to resolvable+hosted domains, a subset of overall domain parking.
      • Bender 1 hour ago
        Yup. That's why I am suggesting to stop that practice and just remove the IP rather than trusting the landing page someone else maintains. Or if one would like to give bots something to do point it to a multicast address or perhaps MoD/US Military address.
  • dvh 1 hour ago
    Yesterday I received spam with link on https://storage.googleapis.com/ that redirected to some parked domain.
  • rickcarlino 58 minutes ago
    Hopefully “direct navigation” does not become a boogeyman like “side loading” has.
    • wlesieutre 44 minutes ago
      Especially when the alternative is "type the company name into google" where the top 3 results are ads and they've previously been seen to stick malware distribution sites above the legitimate company pages

      This was happening for months with blender in 2022/2023, previously collected links about it here: https://news.ycombinator.com/item?id=34917701

  • moralestapia 1 hour ago
    This just happened to me a month ago, I was waiting for a unused domain to expire. The domain was hosted on Epik (which I think is a trashy company but w/e).

    About a month before expiration it somehow got renewed for 10 years, which is weird because it was not available ... and now is hosting a "get-rich-quick" scam that pretends a genuine Petro Canada campaign.

    • homebrewer 1 hour ago
      > About a month before expiration it somehow got renewed for 10 years, which is weird because it was not available

      I've seen some domain registrars auctioning off domains during the last 2-4 weeks before they expire. If nobody buys it, then it actually expires and is then released.

      • HWR_14 59 minutes ago
        Which registrars? I would want to avoid those.
        • reactordev 30 minutes ago
          At the end of the day, no matter your domain, ICANN can just take it for their VC bros. Happened to a friend of mine that owned a pretty novel domain name that a certain social media company wanted. He refused to sell. ICANN and his registrar just transferred it out from under him. Gone. See ya.
          • Tade0 13 minutes ago
            Wow. In light of this it's amazing that Mr. Nissan (RIP) and later his heirs managed to not only retain control of nissan.com, but regain it after it was stolen years after his passing.
  • excalibur 1 hour ago
    The bit about the gmai.com mailserver is disturbing. One would imagine there are many other typo squatters with a similar setup.
    • imglorp 1 hour ago
      I just checked. At least it's not answering on 25 to receive all that free typo mail. Same for gmali.com. But they could spoof the gmail login page. Not finding out.

          PORT     STATE SERVICE
          80/tcp   open  http
          443/tcp  open  https
          8080/tcp open  http-proxy