Most Parked Domains Now Serving Malicious Content

Infoblox’s study finds that direct navigation to parked and typosquatted domains now overwhelmingly leads to malicious outcomes, with over 90% of visits routed through profiling-based redirect chains to scams, scareware, or malware—particularly for residential IP and mobile users. The report documents large-scale typosquatting portfolios (e.g., scotaibank.com, gmai.com) and misconfig typo traps (domaincntrol.com), conditional delivery based on IP/resolver fingerprints, and an ecosystem where parking traffic is resold through affiliate networks until it reaches malicious advertisers, without specific actor attribution.