Domain Parking: Not as Malicious as ExpectedDomain Parking: Not as Malicious as Expected

Domain parking is the practice of assigning a nonsense location to a fully-qualified domain name (FQDN) when it is not in use in order to keep it ready for “live” use. This practice is peculiar because it indicates someone has administrative control over the domain name, does not have hardware ready to respond to requests, but wants the domain to appear active. A more appropriate response would seem to us to be that the domain does not exist. This mismatch between expected benign behavior (no such domain) and actual observed behavior (parking) made us suspicious. In this paper we discuss scalable detection methods for domain names parking on reserved IP address space, and then using this data set, evaluate whether this behavior appears to be indicative of malicious behavior. We find that during the month of January 2014 only 21,328 unique FQDNs exhibited parking on reserved address space, out of over 610 million total unique observed FQDNs. Thus, parking appears to be an uncommon Internet behavior with only 0.0035% of domains exhibiting parking on reserved IP addresses. Of these 21,328 FQDNs, relatively few were observed listed on any of 16 domain blacklists any time from January 1 to February 28, 2014. Only 1,563, or 7.3%, were listed in this time period. Therefore, we conclude that parking is a poor indicator of malicious activity, or at least not an indicator of any kind of malicious activity usually examined by these public lists of malicious domain behavior.