1

Our internet policy blocks so-called 'parked' websites, i.e. those that are registered but do not seem to be active. I'm not sure what tests are used to determine parked status.

There is a tool that my team is looking to use but some of the documentation is on a domain that our filter software has flagged as 'parked' and therefore is inaccessible.

I'm struggling to understand what risks are associated with such 'parked' websites that wouldn't exist for any other type of website. Is the logic here that these sites are useless so why allow access? Have such sites been used historically in attacks? If there are risks, what should constitute a 'parked' website? In this case it seems that all of the 'front-page' documentation was moved to a different domain but some of the deeper detailed artifacts were left behind at an older domain. I would like to better understand how to address this and mitigate any risks.

Improve this question
3
  • Parked domains can be used in conjunction with typo squatting; basically someone registers a domain name close to your own in the hope that a percentage of your employees or clients mistype the URL and end up on the squatted domain. If that happens, these users can be exposed to malicious code, credential theft etc. Lots of companies try to prevent typo squatting by registering the most obvious typo domains along their own, for example goolge.com.
    – knipp
    Jul 17, 2017 at 16:16
  • Some guesswork coming up here: The software your team is using might be looking at the domain status as outlined by RFC2832: ietf.org/rfc/rfc2832.txt?number=2832 (see section 6.1 "Domain Status Code Description"). Anything that is not marked as ACTIVE might be blocked.
    – knipp
    Jul 17, 2017 at 16:17
  • 1
    @knipp Related post from StackOverflow: Method to detect a parked page?
    – WhiteWinterWolf
    Jul 17, 2017 at 16:25

1 Answer 1

Reset to default
1

Parked domains are not dangerous per see, but blocking them may be part of more general safety measures:

  • First, it is obvious that it is not the place you intended to go, so it may be safer to keep you from reaching an unexpected place.

  • Then, these parked domains try to take advantage of a typo in the domain name or hijack a previously existing but not renewed domain to place ads on it and generate benefits with little to no investment. This may not be the type of activity you may want to encourage on the Internet.

  • At last, the same single parked domain page is potentially shown to hundreds of thousands users all domains included. This means that such pages represent a prime target for attackers who may attempt to exploit them in various ways (like distributing malware or supporting spam campaigns).

It may be good to know that while the most straightforward mitigation is indeed to simply block the access to these domains, it is not the only one as it is also possible to forge an alternative DNS answer to redirect the user to what is considered the most likely expected location (this method is core of the OpenDNS company activity for instance).

Improve this answer
3
  • Unfortunately I don't know exactly what about this site makes it considered 'parked' but I take it that it's legitimate to request they move the artifacts.
    – JimmyJames
    Jul 17, 2017 at 17:11
  • @JimmyJames Detecting a parked domain is like detecting any other "suspicious" thing: it relies on some heuristics, some of them being kept as trade secrets by closed-source security solutions providers. While the goal is for the heuristic to be as reliable as possible, false positives still happen. In such case don't hesitate to ask your local administrator to manually add the requested domain in the whitelist to unblock it. This is a common request with such system and should cause no issue.
    – WhiteWinterWolf
    Jul 17, 2017 at 17:23
  • It turns out that the links in question were actually incorrect. If they worked, we would just have found ourselves at a page full of ads. I've contacted the owner about correcting them. But I learned a little and I couldn't find anything else like this question here so I think it's not a total waste.
    – JimmyJames
    Jul 17, 2017 at 18:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .