Feed aggregator

COLUMBUS, Ohio (WCMH) – A partnership built on helping the community is set to enter a new phase after more than 100 years of service. In a statement released Tuesday, the Diocese of Columbus and St. Stephen’s Community House announced that St. Stephen’s will launch as an independent nonprofit organization, no longer serving as a [...]

COLUMBUS, Ohio (WCMH) — A 39-year-old man made his initial court appearance Tuesday morning after being arrested Monday in connection to his wife's death in September. Austen Medek has been charged with murder and received a $3 million cash surety bond in Franklin County Municipal Court. He is accused of killing his wife Michaela Medek, [...]

COLUMBUS, Ohio (WCMH) – A bipartisan Ohio bill that would require correctional institutions to provide free feminine hygiene products to incarcerated women awaits Gov. Mike DeWine’s signature. Lawmakers sent House Bill 29 to the governor’s desk on Dec. 9, after the legislation passed unanimously in both the House and the Senate. DeWine has 10 days, [...]

COLUMBUS, Ohio (WCMH) -- Ohio is getting ready for a statewide cinematic celebration next year as part of the U.S.'s 250th anniversary, with hundreds of free movie screenings planned across all 88 counties. The initiative, Ohio Goes to the Movies, kicks off Feb. 11 and runs through October, highlighting films connected to Ohio through actors, [...]

Direct navigation — the act of visiting a website by manually typing a domain name in a web browser — has never been riskier: A new study finds the vast majority of “parked” domains — mostly expired or dormant domain names, or common misspellings of popular websites — are now configured to redirect visitors to sites that foist scams and malware.

A lookalike domain to the FBI Internet Crime Complaint Center website, returned a non-threatening parking page (left) whereas a mobile user was instantly directed to deceptive content in October 2025 (right). Image: Infoblox.

When Internet users try to visit expired domain names or accidentally navigate to a lookalike “typosquatting” domain, they are typically brought to a placeholder page at a domain parking company that tries to monetize the wayward traffic by displaying links to a number of third-party websites that have paid to have their links shown.

A decade ago, ending up at one of these parked domains came with a relatively small chance of being redirected to a malicious destination: In 2014, researchers found (PDF) that parked domains redirected users to malicious sites less than five percent of the time — regardless of whether the visitor clicked on any links at the parked page.

But in a series of experiments over the past few months, researchers at the security firm Infoblox say they discovered the situation is now reversed, and that malicious content is by far the norm now for parked websites.

“In large scale experiments, we found that over 90% of the time, visitors to a parked domain would be directed to illegal content, scams, scareware and anti-virus software subscriptions, or malware, as the ‘click’ was sold from the parking company to advertisers, who often resold that traffic to yet another party,” Infoblox researchers wrote in a paper published today.

Infoblox found parked websites are benign if the visitor arrives at the site using a virtual private network (VPN), or else via a non-residential Internet address. For example, Scotiabank.com customers who accidentally mistype the domain as scotaibank[.]com will see a normal parking page if they’re using a VPN, but will be redirected to a site that tries to foist scams, malware or other unwanted content if coming from a residential IP address. Again, this redirect happens just by visiting the misspelled domain with a mobile device or desktop computer that is using a residential IP address.

According to Infoblox, the person or entity that owns scotaibank[.]com has a portfolio of nearly 3,000 lookalike domains, including gmai[.]com, which demonstrably has been configured with its own mail server for accepting incoming email messages. Meaning, if you send an email to a Gmail user and accidentally omit the “l” from “gmail.com,” that missive doesn’t just disappear into the ether or produce a bounce reply: It goes straight to these scammers. The report notices this domain also has been leveraged in multiple recent business email compromise campaigns, using a lure indicating a failed payment with trojan malware attached.

Infoblox found this particular domain holder (betrayed by a common DNS server — torresdns[.]com) has set up typosquatting domains targeting dozens of top Internet destinations, including Craigslist, YouTube, Google, Wikipedia, Netflix, TripAdvisor, Yahoo, eBay, and Microsoft. A defanged list of these typosquatting domains is available here (the dots in the listed domains have been replaced with commas).

David Brunsdon, a threat researcher at Infoblox, said the parked pages send visitors through a chain of redirects, all while profiling the visitor’s system using IP geolocation, device fingerprinting, and cookies to determine where to redirect domain visitors.

“It was often a chain of redirects — one or two domains outside the parking company — before threat arrives,” Brunsdon said. “Each time in the handoff the device is profiled again and again, before being passed off to a malicious domain or else a decoy page like Amazon.com or Alibaba.com if they decide it’s not worth targeting.”

Brunsdon said domain parking services claim the search results they return on parked pages are designed to be relevant to their parked domains, but that almost none of this displayed content was related to the lookalike domain names they tested.

Samples of redirection paths when visiting scotaibank dot com. Each branch includes a series of domains observed, including the color-coded landing page. Image: Infoblox.

Infoblox said a different threat actor who owns domaincntrol[.]com — a domain that differs from GoDaddy’s name servers by a single character — has long taken advantage of typos in DNS configurations to drive users to malicious websites. In recent months, however, Infoblox discovered the malicious redirect only happens when the query for the misconfigured domain comes from a visitor who is using Cloudflare’s DNS resolvers (1.1.1.1), and that all other visitors will get a page that refuses to load.

The researchers found that even variations on well-known government domains are being targeted by malicious ad networks.

“When one of our researchers tried to report a crime to the FBI’s Internet Crime Complaint Center (IC3), they accidentally visited ic3[.]org instead of ic3[.]gov,” the report notes. “Their phone was quickly redirected to a false ‘Drive Subscription Expired’ page. They were lucky to receive a scam; based on what we’ve learnt, they could just as easily receive an information stealer or trojan malware.”

The Infoblox report emphasizes that the malicious activity they tracked is not attributed to any known party, noting that the domain parking or advertising platforms named in the study were not implicated in the malvertising they documented.

However, the report concludes that while the parking companies claim to only work with top advertisers, the traffic to these domains was frequently sold to affiliate networks, who often resold the traffic to the point where the final advertiser had no business relationship with the parking companies.

Infoblox also pointed out that recent policy changes by Google may have inadvertently increased the risk to users from direct search abuse. Brunsdon said Google Adsense previously defaulted to allowing their ads to be placed on parked pages, but that in early 2025 Google implemented a default setting that had their customers opt-out by default on presenting ads on parked domains — requiring the person running the ad to voluntarily go into their settings and turn on parking as a location.

COLUMBUS, Ohio (WCMH) -- The Department of Commerce abruptly suspended millions in funding intended to support Ohio's manufactures, citing a federal review of the program that could take years to resolve. The Department of Commerce said the funding is paused due to an ongoing Office of Inspector General review of Ohio's Manufacturing Extension Partnership. The [...]

Former Lazarus employee Ronald Rau donated a Santa figure and Snow Queen to the Fran Ryan Center to help recreate the iconic Christmas window displays and SantaLand of the now-defunct Columbus department store.

COLUMBUS, Ohio (WCMH) – The Ohio Revised Code lays out specific rules for using a mobile device behind the wheel, including addressing whether it is legal to scroll while stopped at a red light or talk on the phone while driving. Ohio implemented a distracted driving law in October 2023, generally banning motorists from using, [...]

WHITEHALL, Ohio (WCMH) -- Whitehall City Council is scheduled to meet Tuesday night to consider the removal of a councilmember accused of underage sexual misconduct. Councilmember Gerald Dixon was arrested the evening of Dec. 8 on allegations of decades of grooming underage boys. The next morning, he appeared in Franklin County Municipal Court and was [...]

COLUMBUS, Ohio (WCMH) -- A woman is dead and another is injured after a head-on collision Monday evening in east Columbus. Columbus police said that at 7:24 p.m., a vehicle pulled from a parking lot to go west on East 17th Avenue near Rarig Avenue. A woman driving a Ford was going west at the [...]

COLUMBUS, Ohio (WCMH) -- The central Ohio Jewish community remains on edge after the terror attack at a Hanukkah celebration in Australia over the weekend.  "You have the shock and then the mourning and then the worry of where else is this going to happen," Katie Rotenberg said. According to JewishColumbus President Julie Tilson Stanley, [...]

COLUMBUS, Ohio (WCMH) -- The City of Columbus said it is strengthening its IT infrastructure to ensure that its policies align with state standards to protect residents' data. This comes more than a year after the city was hit with a ransomware attack that led to half a million people’s sensitive information being posted on [...]

COLUMBUS, Ohio (WCMH) – The U.S. Marshals Service and the Columbus Division of Police are teaming up to find a suspect wanted for pulling a gun on a store clerk in November. According to the Marshals Service, Ian Crum, 35, allegedly walked into the Tractor Supply Company store on West Broad Street last month, loaded [...]

COLUMBUS, Ohio (WCMH) -- As the year comes to a close, NBC4 sat down with Ohio's top law enforcement agent to discuss what happened in 2025 and look forward to next year, the final year of Ohio Attorney General Dave Yost's term. He said he is not focused on the end but rather on the [...]

ASHVILLE, Ohio (WCMH) -- There is nothing that can be done to stop a data center from coming to northern Pickaway County, according to Ashville Village Administrator Bert Cline. This comes as neighbors in the community are protesting the development. Traveling through the main streets in the village of Ashville this time last year, you’d [...]

COLUMBUS, Ohio (WCMH) -- A Columbus man accused of killing his wife in September was arrested Monday and charged with murder. Austen A. Medek, 39, was arrested without incident by a Columbus Police SWAT Team. He is being held at Franklin County Jail. According to police, officers responded to a home on the 5500 block [...]

COLUMBUS, Ohio (WCMH) -- The Ohio Statehouse hosted a historic gathering of legislative leaders from across the country Monday, discussing concerns about the increasing power of the federal government. Senate presidents and House speakers from about 40 states met in the chambers of the Ohio House of Representatives, unanimously adopting a nonbinding declaration for the [...]