Security researchers from Sucuri have discovered a new method through which some companies are adopting questionable practices to make money by inserting unwanted ads into other websites or even hijacking their traffic. This tactic revolves around the use of reserved domains, which are Internet domains that are not associated with a current service, but are registered for future development, resale, or to protect the cyberspace against users who do not have the corresponding copyrights.
According to Sucuri, a company called China Capital Investment Limited (CCI) is re-registering expired domains that have a large number of backlinks. “Backlink” is a term used when your website’s content is embedded and linked from content on other websites.
Sucuri says CCI has registered 196,879 domains, which were frozen as soon as they were registered. The company spent about $2 million registering the domains and apparently uses a script that looks for backlinks on the frozen domains.
If the script detects an image, it responds with an advertisement. For example, if you find an image on the internet that you like and decide to embed it on your website using its link (say former-site.com/image.png), after the domain expires, the image will stop working.
When CCI buys the former-site.com domain and binds it, malicious script will continue to respond to image requests, but instead of the original image, it will display an ad.
The same thing happens with JavaScript files . If, for example, you use a .js file hosted by another website, which in the meantime expires and is purchased by CCI, the previous domain will display a JS malicious code that will redirect all traffic from your site to the blocked domain, where ads will be displayed, for the benefit of CCI.
Aside from making money from hijacking the image and the JS backlinks via the parked domains, CCI also sells the acquired domains on domain marketplaces, in an effort to earn as much money as possible from its controversial business model.
Although not many people usually link JS files to other websites, there are a lot of bloggers and news sites that embed images on their websites from other sources.
These users are now unknowingly serving unwanted ads to their users and we are helping CCI increase its profits. Below you can see an image showing the type of ads CCI serves through its reserved domains.
