Cybersecurity firm Kaspersky has warned that parked domains, registered but undeveloped web addresses, are being exploited by fraudsters to harvest user data and launch attacks.

While appearing as harmless placeholder pages, these sites can run hidden scripts that collect IP addresses, geolocation, browser details, and unique device fingerprints via Canvas, WebGL, and audio-fingerprinting. This data is often sold to ad networks for targeted profiling without user consent.

Beyond tracking, parked domains can enable malicious redirects to fraudulent platforms, adult content, or online casinos. Typosquatting, mistyping a popular brand’s URL, can also land users on phishing sites that steal credentials or install malware through drive-by downloads.

A Kaspersky expert warned that users mistakenly view blank pages as harmless, risking personal data, financial security, and corporate access.

To counter such risks, the firm recommends avoiding suspicious links, double-checking URLs for typos, using security software with anti-tracking and anti-fingerprinting features, and closing parked domain pages immediately while clearing browser cache and cookies.