Loading story…
Palo Alto Networks' Unit 42 reported that parked domains present elevated security risk and are frequently repurposed for malicious activity, including malware delivery, abusive redirects, and impersonation scams. In an analysis of domain activity between March and September 2020, researchers identified about 5 million newly parked domains and observed 6 million parked domains transition to other categories; 1.0% became malicious, 2.6% shifted to not-safe-for-work content, and 30.6% were classified as suspicious.
The report documented several abuse patterns in which attackers registered parked domains and later weaponized them, while some parking services exposed users to invasive tracking or harmful advertising chains. Case studies included an Emotet campaign using valleymedicalandsurgicalclinic[.]com, exploit-kit and survey redirects tied to peoplesvote[.]uk, and typosquatting abuse through xifinity[.]com, which redirected visitors to a fake McAfee-themed scare page. Unit 42 said organizations should monitor or block parked domains because they can rapidly shift from inactive holdings to active attack infrastructure.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
By September 14, 2020, WildFire captured malware hosted at valleymedicalandsurgicalclinic[.]com/ujftb/statement/wr7hoba7i9hz. Palo Alto Networks linked the domain to a global Emotet phishing campaign targeting multiple sectors and countries.
From March to September 2020, Palo Alto Networks identified 5 million newly parked domains and observed 6 million parked domains transition to other categories. It found that parked domains were far more likely than benign domains to become malicious, suspicious, or not-safe-for-work.
The domain valleymedicalandsurgicalclinic[.]com was registered and was initially classified by Palo Alto Networks as a parked domain based on its website content.
Palo Alto Networks documented abuse of the parked domain peoplesvote[.]uk, where visitors were intermittently redirected from an ad listing page to 0redira[.]com/jr.php and then sometimes to a U.S. election-themed survey site. The activity was attributed to insufficient advertisement control by the parking service above[.]com.
Palo Alto Networks reported that it had been detecting parked domains for more than nine years, establishing the long-term basis for its later analysis of abuse in the domain parking ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have uncovered that the majority of parked domains—websites that are expired, dormant, or typographical variants of popular sites—are now being weaponized to serve malicious content. Instead of merely displaying harmless search advertisements, these domains frequently redirect users to scams, malware, and other deceptive content, especially when accessed directly by users rather than automated scanners or VPNs. The threat is exacerbated by the use of lookalike domains, which can easily trick users into visiting malicious sites, as demonstrated by a case where a user attempting to reach the FBI’s Internet Crime Complaint Center was redirected to a scam page after mistyping the domain. The research, led by Infoblox and reported by multiple sources, found that over 90% of visits to parked domains now result in exposure to illegal content, scareware, or malware. The complex ecosystem of domain parking and advertising makes it easy for threat actors to hide their activities and difficult for defenders to attribute attacks. Automated security tools often fail to detect these threats because parked domains can serve benign content to scanners while delivering malicious payloads to real users. This shift marks a significant escalation in the risk associated with direct navigation to parked or typo-squatted domains.
Jun 29, 2026
Palo Alto Networks reported widespread abuse of cybersquatting domains that imitate major brands including **Facebook, Apple, Amazon, Netflix, Microsoft, Samsung, Walmart, and Wells Fargo** to conduct phishing, malware delivery, command-and-control, technical support fraud, reward scams, re-bill scams, and parked-domain monetization. In one month of observation, researchers identified **13,857** squatting domains—about **450 per day**—with **2,595** classified as malicious and **5,104** as suspicious or high risk, showing how frequently newly registered lookalike domains are weaponized against consumers. The activity used multiple squatting techniques, including **typosquatting, combosquatting, homograph-squatting, soundsquatting, bitsquatting, and level-squatting**, and often targeted profitable sectors such as search, social media, shopping, finance, and banking. Examples included `secure-wellsfargo[.]org` for phishing, `samsungeblyaiphone[.]com` for **Azorult** malware distribution, `microsoft-store-drm-server[.]com` for C2 activity, `microsoft-alert[.]club` for a technical support scam, and `netflixbrazilcovid[.]com` for a re-bill scam; researchers also found that more than half of the malicious or high-risk domains were not detected by any VirusTotal vendors during the comparison window, underscoring significant detection gaps and the need for continuous monitoring of newly registered domains and passive DNS data.
Aug 14, 2026
Researchers found that registrable domains commonly used as documentation placeholders—including `yoursite.com`, `your-domain.com`, and `third-party.com`—have been operated as malicious infrastructure. Manifold Security reported that the first two domains appear in roughly 359,000 GitHub files and 349 AI-agent skills; browser testing showed JavaScript-driven, cloaked redirect chains affecting tested macOS sessions, including fake security alerts leading through affiliate infrastructure and fraudulent investment pages. The abuse evaded static reputation and registry checks because final destinations were assembled at runtime in a real browser. Separately, `third-party.com`, long used as a development-documentation example, was reported as infrastructure for a ClickFix attack. The incidents demonstrate that examples using registrable domains can become dangerous without any change to the original code, skill, or documentation. Organizations should inventory documentation, repositories, AI-agent skills, and user guidance for non-reserved placeholder domains, replace them with IANA-reserved names such as `example.com` and `example.org`, and treat visits to legacy example links as potentially untrusted.
Sep 29, 2026