The response does not come from a real site but from a domain parking, for-sale or traffic monetization platform: a parking provider banner, a parking or traffic-broker cookie, or a redirect into a known parking marketplace.
The questions every analyst asks before acting on this signal.
The response does not come from a real site but from a domain parking, for-sale or traffic monetization platform: a parking provider banner, a parking or traffic-broker cookie, or a redirect into a known parking marketplace.
Not by itself, which is why this label carries low severity and impact. It matters because there is no genuine content to judge, parked inventory is routinely resold into malvertising and traffic-broker chains, and many parked domains are recently expired brands that attackers buy for their residual traffic.
'Parking With Visitor Profiling' is set when parking or traffic-broker cookies appear together with visitor profiling cookies such as city, country, language or system, which is the signature of geo-targeted cloaking rather than a passive for-sale page.
A realistic shape of the entry the engine appends to the risk_signals array when this signal fires. Evidence keys are subgroup-default; per-signal overrides documented in the API reference.
{
"slug": "http_parking_profile",
"name": "Parked Domain Infrastructure",
"group": "http_crawling_history",
"subgroup": "http_header_behaviors",
"direction": "malicious",
"evidence": {
"missing_security_headers": 4,
"cors_origin": "*",
"cors_credentials_allowed": true,
"provider_type": "self_hosted",
"risky_cookie_count": 2
}
}12 other signals share the same subgroup. They detect related behaviors and often co-fire on the same IOC.
It indicates abnormal HTTP redirection patterns such as instant refresh redirects, header-based redirects, forced interm…
It indicates that the site sets cookies issued by specific edge protection providers whose cookies appear far more often…
It identifies who actually serves the domain: a CDN, a managed website platform, a free hosting platform, a security pro…
It indicates the domain returns a small but deliberate set of custom HTTP headers, which is typical of sites running on …
The Verdict Gallery is a curated stream of real verdicts. Filter by this signal to see exactly which IOCs it caught, what other signals fired alongside it, and what the engine recommended.
1,000 verdicts/month on the free tier, LLM layer included. No card required.