Repository navigation
Conversation
elhoim
marked this pull request as draft
September 7, 2026 09:14
elhoim
force-pushed
the
auto-parking-domain-live
branch
from
September 7, 2026 10:03
6456a1f to
f47846a
Compare
elhoim
changed the title
elhoim
force-pushed
the
auto-parking-domain-live
branch
from
September 7, 2026 10:39
f47846a to
14aed0c
Compare
elhoim
changed the title
…ent and verified research indicators Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
elhoim
force-pushed
the
auto-parking-domain-live
branch
from
September 7, 2026 10:43
14aed0c to
685c4e7
Compare
Member
|
Looking quickly at the code, there are some heuristic to detect the parking pages. It's clearly a good idea but my worries are on the false-positive side and we could limit those. Feel free to update the PR. |
Contributor
Author
Any suggestions on how to limit potential FPs? |
Resolve the version conflict in lists/parking-domain/list.json: keep this branch's measured list together with upstream's new "category": "known" field, and set version to 20261016 so that it is newer than upstream's 20261014 and instances re-import the changed list. The generator keeps the category, since it rewrites only list and version. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
elhoim
marked this pull request as ready for review
October 16, 2026 22:25
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BLUF
The ranges currently in this list that the study disproves
list.jsontoday103.224.182.0/23,103.224.212.0/23ns1–5.above.com: www.mamma.com (live metasearch), www.girl.com.au, www.femail.com.au (media sites), and a DirectAdmin shared-hosting estate (ns20–31.hostedbyhelp.com). Listing it would suppress live consumer sites.91.195.240.0/2391.195.241.13→mta-production.sedo.com, Sedo's production mail transfer agent.185.53.176.0/22185.53.176.22→infra.teaminternet.de, corporate infrastructure. Two individual addresses inside it are listed.217.70.184.38/32,217.70.184.50/32217.70.184.0/24: 100 PTRs, 97 of them general*.gandi.netload-balancer services.webrediris Gandi's redirect service generally, not parking-only.198.54.117.192/26198.54.112.0/20general hosting and DNS estate.52.222.x,13.225.x,13.248.x,75.2.x,34.102.xReplacing rather than unioning is what removes them.
What this costs — read this first
106 committed entries are dropped, and most are not disproven. Parking landers are virtual hosts: asked by bare IP they return a generic default page, and only return a parking page when the request carries the
Hostheader of a domain actually parked there. For a committed address with no known parked domain to name, the check cannot reach the lander.Measured directly: of the 108 committed entries, only 8 can be proven from a bare-address probe. A maintainer restoring a dropped entry by hand is a legitimate act, not a fight with the generator — every drop is logged by name in
generators.log.If that trade is not the one you want, the code unions instead of replaces by changing one line (
entries→committed.union(entries)). Say the word.The 18 entries
From live measurement (8) —
MIN_DOMAINS = 5, evidence required, and the address must not sit on a shared network:194.9.94.85/32,194.9.94.86/32Parked at Loopia46.30.211.38/32domain-parking.one.com— already committed185.8.237.22/32,2a0e:acc0::d22/128domain-default.wedos.global2.57.91.91/32Parked Domain name on Hostinger DNS system2a01:5b40:0:bc03::1/128golfhem.se is parked185.134.245.113/32parkedweb01.domeneshop.no— already committedFrom the Atlas (10) — each passed the registry, sweep and behaviour tests:
199.59.243.50/32199.59.240.0/22185.53.179.200/32185.53.179.0/24, AS206834; 0 PTRs; serves lb, lp, ns3.parkingcrew.net64.190.63.136/3264.190.62.0/23; 0/510 PTRs; servesServer: Parking/1.0104.247.81.99/32104.247.80.0/22NetName NEXTD; 0/1022 PTRs185.53.177.29/32208.91.196.4/32,208.91.196.7/32,208.91.196.138/32208.91.196.0/23; 0/510 PTRs208.91.197.7/32208.91.197.0/24; 0 PTRs199.79.60.7/32199.79.60.0/24; 0/254 PTRsEvidence of parking is necessary but not sufficient
Loopia fronts part of its parking estate with Cloudflare, so
188.114.96.0and188.114.97.0genuinely answerParked at Loopia— and listing them would suppress every other site behind those Cloudflare edge addresses. An earlier run of this generator did exactly that; run-to-run variance caught it.So each candidate's owning network is now read from Team Cymru over DNS (
<reversed-ip>.origin.asn.cymru.com, thenAS<n>.asn.cymru.com) and rejected if the AS name is a CDN, cloud or PaaS provider. That is the study's own §11 technique, and it enforces its §03 categorical rejections in code rather than in prose. Four Cloudflare addresses are excluded by it today, each logged with the reason. No API key required.high = the sweep found PTR evidence supporting parking and nothing contradicting it. medium = the sweep found no PTRs at all — absence of contradiction, weaker than proof. AS40034 (Confluence/Skenzo) publishes no reverse DNS in any of its 25 prefixes, so those rows are unfalsified rather than demonstrated. Drop the medium rows if that is not tolerable; the three high ones stand alone.
Each indicator carries its operator, confidence and evidence as a comment in
RESEARCH_INDICATORS, so the claim is re-checkable rather than taken on trust.Why no dataset
tma22-parking.github.iogithub.com/bambenek/parkingipaddressesLimitations, stated plainly
.se,.sk,.nu. It finds operators serving those registries and no others. The Atlas indicators are what give the list global operators.under construction/coming soonare deliberately not parking markers — they matched shared web-hosting front ends in testing (webfront6.webcluster.loopia.se).cidr-typed so it can only carry the fifth; the first two belong inparking-domain-ns(see [medium] Add parking-domain-ns warninglist generator #442).Implementation notes
list.jsonincluded so the deletions are reviewable; drop that hunk to regenerate yourself.generate_all.sh. Supersedes [low] Add generate-parking-domain.py: reproducible import from the TMA 2022 parking artefact #447.Full copy of the research — Parked Domain Infrastructure Atlas (resolved 2026-09-07)
Source: https://claude.ai/code/artifact/95af3f16-f41c-48e2-bdc5-f4c651eff96d
Method chain: DNS → HTTP → Team Cymru ASN → RIPEstat whois → reverse sweep. Resolvers 8.8.8.8 / 1.1.1.1 / 9.9.9.9, European vantage point. 7,477 hostnames probed · 1,133 IPv4 enriched · 9,698 reverse-DNS lookups · 10 IPs verified exclusive · 0 ranges passed.
01 — The short version
Do not detect parked domains by IP address. After verification, exactly 10 IPv4 addresses out of the 1,133 resolved can be attributed exclusively to parking. Not one range passed. Everything else is Cloudflare, AWS, Akamai, a registrar's general DNS estate, or a parking company's own network shared with its non-parking business.
Detect on nameserver delegation and CNAME target instead. Those are stable, operator-specific, and survive a hosting migration. The verified IPs are a supplement, never the primary rule.
Revision note: this is the second revision. The first draft published five "dedicated parking networks" as prefix indicators. Each was then tested by reverse-sweeping its full RIR assignment. Three of the five failed and were removed — Trellian/Above.com, GoDaddy's aftermarket estate, and Sedo's
91.195.240.0/23.Detection order of preference: (1) NS RRset match — primary rule, cheap, stable, low false-positive rate. (2) CNAME target match. (3) HTTP response fingerprint —
Server: Parking/1.0, status 436/445. (4) PTR fingerprint — AWS Global Accelerator IDs. (5) The 10 verified IPs, supplementary only. (6) Any range — don't; none passed.02 — Verified IP indicators
An address appears only if all three tests hold. Registry test: the covering RIR assignment (
inetnum/NetName, RIPEstat whois) is registered to the parking operator itself, not a cloud/CDN/hosting provider reselling it. Sweep test: a reverse-DNS sweep of every address in that assignment returned no hostname belonging to a non-parking service. Behaviour test: the address was observed serving a parking response, or is the A record of a parking-only hostname.199.59.243.50185.53.179.20064.190.63.136Server: Parking/1.0.208.91.196.138104.247.81.99185.53.177.29infra.teaminternet.de. The range is not exclusive; this address is.208.91.197.7208.91.196.4208.91.196.7199.79.60.7Reading the confidence column: High = the sweep found PTR evidence positively supporting parking use and nothing contradicting it. Medium = the sweep found no PTR records at all in the assignment — absence of contradicting evidence, weaker than proof. AS40034 announces 25 IPv4 prefixes and publishes no reverse DNS anywhere in them, so exclusivity there is unfalsified, not demonstrated; and Confluence Networks was Directi's general network operator, which historically carried more than parking.
No CIDR ranges are published anywhere in this document. Every range tested contained something that was not parking.
03 — Ranges tested and rejected
103.224.182.0/23,103.224.212.0/23ns1–5.above.com: www.mamma.com (live metasearch engine), www.girl.com.au, www.femail.com.au (media sites),da03-san.hostedbyhelp.comandns20–31.hostedbyhelp.com(a DirectAdmin shared-hosting estate),ns1/ns2.drop.com.au,dns1.netfleet.com.au(drop-catch registrar),www.domainstate.com,passport.trillion.com.97.74.98.0/23,173.201.66.0/23*.secureserver.net— GoDaddy's general customer DNS estate. Only 5 relate to Afternic, Dan or Namefind.91.195.240.0/2391.195.241.13→mta-production.sedo.com, Sedo's production mail transfer agent.185.53.176.0/22185.53.176.22→infra.teaminternet.de, corporate infrastructure.95.130.16.0/21*.mail-gw.de,*.secure-mx.de,*.internetwire.de,*.partnergate.com— mail gateways and unrelated hosting. ParkingPanel is one host in it.217.70.184.0/24*.gandi.netload-balancer and platform services.104.143.9.0/24*.directnic.net— a different company.66.81.203.0/24CN, inside66.81.192.0/20(Psychz Networks)198.54.112.0/20162.159.16.0/20,162.159.24–27.0/24,104.16–104.20.xdyna-ns.net), NameSilo (dnsowl.com) and Hostinger (dns-parking.com) and the registrar DNS of Dynadot, Network Solutions, Openprovider, Porkbun, Spaceship, 101domain, Dotster and Crazy Domains and a large fraction of the public internet.13.248.x,76.223.x,75.2.x,34.x,54.x199.59.243.0/24199.59.240.0/22, none non-parking. ASN data alone would have discarded this as "AWS". The RIR assignment is what saved it.Check the registry, not just the origin AS — and check reverse DNS, not just the registry. They answer different questions.
04 — Nameserver indicators (primary detection surface)
Parking NS — assigned by a parking service to a customer's parked domain:
ns1/ns2/ns3/ns4/ns5.above.com·ns1/ns2.abovedomains.com·ns1/ns2.trellian.com·ns1.adtiger.com·ns1/ns2/ns3.afternic.com·ns1/ns2.dyna-ns.net(Bodis) ·ns1.brandbucket.com·ns1.brandpa.com·ns1/ns2/ns3.dan.com·ns1.undeveloped.com·ns1.digimedia.com·ns1.domainadvertising.com·ns1.domainagents.com·ns1.domainpower.com·ns1.domainspa.com·ns1/ns2/ns3.dsredirection.com·ns1.domainify.com·ns1.dropcatch.com·ns1.4cun.com(Ename) ·nameservices.net,ns1/ns2.nameservices.net,ns1.fabulous.com·ns1.flippa.com·ns01.cashparking.com(GoDaddy) ·ns1/ns2/ns3/ns4.dns-parking.com(Hostinger) ·ns1.internetreit.com·ns1.internettraffic.com·ns1.namedrive.com,ns1.namedrive.net,ns2.namedrive.com·ns1.namejet.com·ns1/ns2/ns3.dnsowl.com(NameSilo) ·ns1.namefind.com·ns1.park.io·ns1/ns2.parklogic.com·ns1.parkedin.com·ns1/ns2/ns3.parkingcrew.net,ns1.parkingcrew.org,ns1/ns2.pcrewdns.net·ns1/ns2.parkingpanel.com·ns1.parkingspa.com·ns1.parkingdots.com·ns1.perfectdomain.com·ns1.redirect.com·ns1/ns2.rookdns.com·ns1/ns2.sedo.com,ns1/ns2/ns3.sedoparking.com,ns1.sedoparking.de·ns1.skenzo.net,ns1/ns2.ztomy.com·ns1.snapnames.com·ns1.theparkingplace.com·ns1.tonic.com·ns1.trafficz.com·ns1.verticaldevelopment.com·ns1.dnsnuts.comRegistrar NS — a registrar's default DNS, appearing on parked and live domains; context, never a standalone detection:
ns1.101domain.com·ns1.22.cn·ns1.alidns.com·dns1/ns1.hichina.com·ns1.ascio.net·ns1.blacknight.com·ns1.crazydomains.com·f1g1ns1.dnspod.net·ns1.dotster.com·ns1.dynadot.com·ns1.ename.net·ns1.eurodns.com·a.dns.gandi.net·ns1.ispapi.net·ns1063.ui-dns.com·ns1.internetx.de·ns1.rrpproxy.net·ns1.markmonitor.com·ns1.moniker.com·dns1/dns2.registrar-servers.com,registrar-servers.com·ns1.netim.net·ns1/ns2.worldnic.com·dns.ovh.net·ns1.openprovider.nl·ns1.mydomainprovider.com·curitiba.ns.porkbun.com·ns1.reg.ru·ns1.yourdomainprovider.net·launch1.spaceship.net·ns1.now.cn·ns1.udag.net·ns1/ns2.myhostadmin.net·ns1.wixdns.netOnly seven of the nameservers in the study sit on address space usable as an IP indicator:
ns1.domainadvertising.com,ns1.namedrive.net,ns3.parkingcrew.net,ns3.sedoparking.com,ns1.skenzo.net,ns1.ztomy.com,ns2.ztomy.com. Everything else is Cloudflare, AWS, or a general hoster.05 — Parking landing pages
lb-182-250.above.com,park.above.comApacheafternic.com,www.afternic.comafternic.com.sni-only.edgekey.net→e126871.dsca.akamaiedge.netenvoyatom.com,squadhelp.comcloudflarebodis.combrandbucket.comundeveloped.comdomainmarket.comcloudflaredsredirection.comnginx/1.14.2parking.dynadot.comefty.com,lp.efty.comwebredir.gandi.netaftermarket.godaddy.com,mcc.godaddy.com,parked-content.godaddy.com*.edgekey.net→e6001.*.akamaiedge.netAkamaiGHostcashparking.com,parked.godaddy.comhugedomains.comcloudflareparkingpage.namecheap.comparking.d.parity.domainsnginx/1.28.3namefind.comApachelb.parkingcrew.net,lp.parkingcrew.net,parkingcrew.netparkingcrew.comawselb/2.0parking.reg.runginxsedoparking.comParking/1.0ww1/ww25/ww38.sedoparking.comParking/1.0ztomy.comnginx/1.28.0parking.teaminternet.comteaminternet.comsitedomains.enom.comnginx06 — Distinctive fingerprints (highest fidelity; none is an IP)
Server: Parking/1.0sedoparking.comand everyww<N>.sedoparking.com. Also returns non-standard status codes 436 and 445 — almost nothing else on the internet does.^ww\d+\.sedoparking\.com$wwNNhost per parked domain. Match the pattern, not any single number.^ns\d{4,6}\.ztomy\.com$a94f3aae71d6f0705.awsglobalaccelerator.coma904c694c05102f30.awsglobalaccelerator.coma45d5eda59d380dac.awsglobalaccelerator.compcrewdns.net)a94b1fcceee8ac9d4.awsglobalaccelerator.comparking.d.parity.domains*.edgekey.netfromparked-content.godaddy.comns1.above.comon a hostname not under above.comdns1/dns2.parking-page.netskenzo.netitself.redirect.ovh.net213.186.33.5— that address is OVH's shared redirect service.webredir.vip.gandi.net,webredir.gandi.net217.70.184.0/24range is not.07 — Shared answers and brand fronts
These addresses are evidence of common ownership, not detection indicators — most sit in ranges rejected in §03.
103.224.182.77,.85,.9,103.224.212.9103.224.182.10,103.224.212.10,.51,.53149.28.95.1050.116.34.3469.39.238.3697.74.99.6413.248.169.48,76.223.54.146Roughly 100 brands collapse into about 15 platforms. Above.com = TrafficZ = Rook Media = DomainPower (one Trellian platform, four fronts). Park.io = ParkLogic. Afternic = Dan.com = Undeveloped. Namefind = InternetTraffic = Parkingdots = Internet REIT. DomainSponsor/Oversee → Skenzo. NameDrive → Team Internet. Write detection logic against the platforms, not the brands.
08 — Two live changes that break existing rules
Namecheap.
parkingpage.namecheap.com— historically a stable A record in198.54.117.208–218— now returnsCNAME parking.d.parity.domains, resolving to104.219.250.36(Namecheap AS22612) and2.59.170.19(WorldStream B.V., NL — AS49981). The legacy198.54.117.210still carries PTRparkingpage.namecheap.com. A rule pinned to198.54.117.0/24is now partially blind — and that /20 is Namecheap's general hosting estate, rejected in §03. The parity.domains CNAME is the indicator.GoDaddy.
parked-content.godaddy.comandaftermarket.godaddy.comare now Akamai-fronted (*.edgekey.net→e6001.a.akamaiedge.net). Parked-page detection by GoDaddy IP is no longer viable at all: the old184.168.221.0/24and34.102.136.180addresses are legacy, and184.168.128.0/17is GoDaddy's general hosting /17. Use the edge hostname.09 — Registrar default parking
No IP indicators appear here — every registrar range tested failed §03, because a registrar's DNS estate serves its live customers too.
ns1/ns2.domaincontrol.com;ns01.cashparking.com→cpns01.secureserver.netparked-content.godaddy.com→*.edgekey.net;parked.godaddy.com;mcc.godaddy.comdomaincontrol.comsits under ~90M domains — never an indicator alone.dns1/dns2.registrar-servers.comparkingpage.namecheap.com→parking.d.parity.domainsns1/ns2.name-services.com;redirector-sjl.enom.comsitedomains.enom.comns1.squarespacedns.comdns1/dns2.onamae.comns1.dynadot.comparking.dynadot.comns1/ns2/ns3.dnsowl.comdnsowl.comdelegation is the signal — cheap and high-fidelity.ns1–ns4.dns-parking.com84.32.84.32(untested for exclusivity — not an indicator)dns-parking.comis self-documenting.ns1063.ui-dns.comand siblingsns1/ns2.worldnic.compark.dnsrsrvr.com,parkpage.foundationapi.comdns.ovh.net,ns*.ovh.netredirect.ovh.net213.186.33.5is OVH's shared redirect host — widely seen, but not parking-exclusive.a/b/c.dns.gandi.netwebredir.vip.gandi.netns1.rrpproxy.netns1/ns2.parkingpanel.comdns1.hichina.com,ns1.alidns.comns1/ns2.myhostadmin.net10 — Operationalising it
Rule shapes. Microsoft Sentinel — a watchlist of parking-NS suffixes joined against
DnsEventson the answer field; keep any IP watchlist to the ten §02 addresses, if you use one at all. Splunk — a lookup keyed on NS suffix, driven fromtstatsover an accelerated Network_Resolution data model matchingdns.answer, not a raw search overindex=dns. Zeek / Corelight —dns.logwhereanswersmatches the parking-NS list, plushttp.logwhereserver == "Parking/1.0". Sigma —dns_querywithanswer|endswithon the NS suffix list.What a parked-domain hit actually means. Parking is not malicious. Treat it as an enrichment and scoring signal rather than an alert — "the C2 domain is now parked" changes triage priority. It is a lapse or takedown indicator: a formerly-active malicious domain that starts resolving to Sedo or ParkingCrew has usually expired or been seized. And it is a hunting pivot: clustering tenant DNS by parking operator surfaces typosquats and lookalikes.
False positives to expect. Legitimate businesses park domains they own — defensive registrations, brands in transition, redirect-only domains. Score it; don't alert on it.
11 — Coverage, method and honest gaps
Verification chain. 7,477 candidate hostnames generated across 244 zones → 1,807 resolved → 1,133 unique IPv4 enriched with PTR and Team Cymru ASN/prefix → 175 landing hosts fingerprinted over HTTP(S) → 19 candidate ranges checked against RIPEstat RIR whois → 9,698 reverse-DNS lookups sweeping 15 full assignments. Every record observed live on 2026-09-07 from a European vantage point. Nothing is from a published list.
What the exclusivity test can and cannot show. A sweep that finds a non-parking hostname disproves exclusivity — a hard result, and what removed Trellian, GoDaddy, Sedo's /23, Key-Systems and Gandi. A sweep that finds nothing fails to disprove exclusivity, which is weaker; five of the ten §02 addresses rest on that weaker footing and are marked Medium. There is no way from here to enumerate every domain hosted on an address, so nothing in this document is proof of exclusivity — only "tested, and nothing contradicted it".
Known gaps. (1) 88 of 223 targeted parking hostnames did not resolve. Many operators are defunct (WhyPark, DomainApps, Ninja Parking, Kontera, Rockhoster, Parked.com) or absorbed (NameDrive → Team Internet, Undeveloped → Dan.com → GoDaddy). A "top 100 parking companies" list is a historical artefact; roughly 15 platforms operate today. (2) Chinese and Japanese operators are under-covered —
ns1.alidns.com,dns1.hichina.com,ns1.ename.net,ns1.4cun.com,f1g1ns1.dnspod.netandns1.22.cnreturned IPv6-only answers or nothing; re-run from an APAC vantage point if that coverage matters. (3) No passive DNS — the single biggest available improvement: feed the §04 nameserver list into pDNS and pull every domain delegated to them.Refresh cadence. Hostnames and CNAME targets are stable — re-resolve monthly. The ten verified IPs sit on small operator-owned assignments and move rarely, but re-run the §03 sweep quarterly: an operator that starts co-locating other services in a listed assignment silently invalidates that row.
Two techniques worth keeping. Team Cymru over DNS —
<reversed-ip>.origin.asn.cymru.com TXTreturnsASN | prefix | CC | registry | date, andAS<n>.asn.cymru.com TXTreturns the AS name. No API key, no rate-limit negotiation, fine at thousands of lookups. RIPEstat whois before trusting an origin AS —199.59.243.0/24is announced by Amazon but registeredNetName BODIS-COM. Origin-AS data alone would have discarded a genuine indicator, and would equally have kept the Trellian ranges that a reverse sweep then disproved.