Most Parked Domains Now Serving Malicious Content

Direct navigation has become riskier as a new study finds that the vast majority of parked domains now redirect visitors to scams, malware or other unwanted content. Infoblox researchers say that in large-scale experiments, over 90% of visits to a parked domain ended in illegal content or malware, with the traffic often sold through advertising networks to further redirects.

The report highlights typosquatting domains such as scotaibank[.]com and gmai[.]com, and notes that the owner of these domains has a portfolio of nearly 3,000 lookalike domains targeting dozens of major sites, including Craigslist, YouTube, Google, Wikipedia, Netflix and others. It also explains that one actor’s misconfigured domain only redirects when the query comes from Cloudflare’s DNS resolvers (1.1.1[.]1), while other visitors see a blocking page.

According to Infoblox, policy changes by Google may have unintentionally increased risk by shifting parked-domain ads to opt-out by default, and a defanged list of the typosquats is available here. This was published on 16 December 2025.