56 of our 2,444 domains were hijacked.
Nobody knew.
Not hacked. Not phished. Just idle domains pointing at infrastructure we'd released — claimed by strangers and turned into scam redirects on our brands, for months, invisibly. Your parked domains are the softest target you own:
No signup · the same check that found ours
If you own more than a handful of domains, some of them are idle: old brands, campaign domains, defensive registrations, future projects. They're not in your analytics, not in your uptime monitor, not in anyone's daily report. That's exactly what makes them the softest target you own.
The dangling-DNS play — the #1 way idle domains get taken, and it needs no password, no exploit, and no mistake you'd ever notice.
How idle domains actually get caught
The most common path needs no password and no exploit. A domain's DNS points at infrastructure you used to rent — an old VPS, a decommissioned server, a hosting plan you cancelled. Someone else signs up, gets assigned that same address, and suddenly your domain serves their content: scam redirects, phishing pages, link-farm doorways — under your brand, burning your reputation and your email deliverability. Nobody emails you when it happens.
And there are more ways in than most owners realise. Every one of these has happened to real portfolios:
- You buy a dropping or expired domain. It arrives carrying the previous owner's nameservers. If their hosting account still answers, your new acquisition serves their content from day one — and you may not look for weeks.
- You transfer registrars and forget the nameservers. The domain keeps the old registrar's DNS. Their zone keeps answering — or gets deleted, and the domain drops off the internet entirely. Either way you're not in control of what it serves.
- Registrar defaults change underneath you. Default nameservers get repointed at the registrar's own parking and monetization. No email, no diff — their ads, your brand.
- You change hosts and don't update the idle domains. The money site gets migrated carefully; the parked ones keep pointing at the old IP. That IP gets recycled, claimed, and weaponized — this exact vector is how 56 of our own domains got caught.
- Someone "tidies up" DNS. A well-meaning cleanup at the zone or account level strands domains nobody owns up to — records deleted, delegations broken, nobody alerted.
- Subdomain delegations rot. A CNAME to a dead third-party service is the same play one level down: the service lapses, the name gets re-registered, and
promo.yourbrand.combelongs to someone else.
None of these are exotic. They're the ordinary entropy of owning domains at scale — and they're invisible until someone, or something, looks.
We know because it happened to us: a sweep of our own 2,444-domain estate found 56 domains serving third-party scam redirects. Nobody knew — until we looked. That's the product origin story, and it's why the free check exists.
Our own estate at sweep day. Yours looks like this too — everyone's does. The full data from that sweep (including what the hijackers were serving) is on the real attacks page.
Check a parked domain free — 10 seconds
Why every day matters (for the "it's just parked" crowd)
A hijacked domain isn't inert — it's actively spending the value you paid to build it. Your domain's integrity, authority and rating are assets that appreciate over years and burn in weeks:
- Authority leaks out daily. Every old backlink pointing at your domain is now lending its authority to a scam operation. The longer they benefit, the more of your profile Google re-attributes to their content.
- Trust flags are sticky. Safe Browsing warnings, spam flags, blocklist entries — a domain that served scams gets a reputation that outlives the hijack itself. Some never fully recover; the domain becomes permanently discounted real estate.
- Index poisoning compounds. Every day their pages rank on your domain, your brand's search results fill with their content. Un-indexing that takes months after you take the domain back.
- Email gets dragged down with it. Scam content on your domain poisons the domain's mail reputation too — your legitimate business email starts landing in spam, and you won't connect the dots for weeks.
- Recovery cost grows. A hijack caught in a week is a redirect and a cleanup. A hijack caught in a year is a reputation-rebuild project — disavow work, reconsideration requests, blocklist delisting, brand damage you can't invoice anyone for.
Left long enough, a hijacked domain ends up effectively black-flagged by search engines — worth less than nothing, because now it costs money to rehabilitate. The fix is embarrassingly cheap by comparison: someone watching, every hour, who tells you the day it flips.
What SEO Sink watches on every idle domain
- Registry state — expiry, redemption, holds, transfer locks, nameserver changes. If your domain moves or sickens, you know the same day.
- DNS targets — every record's destination, checked for dangling pointers at released infrastructure and known parking services that monetize your brand with their ads.
- Content — what's actually served on the domain today. When an idle domain starts serving content you didn't put there, that's the alarm — caught by scan, not by a customer complaint.
And when a parked domain becomes a real site
Domains graduate. Our scans see the transition automatically — an idle domain that starts serving a real site is detected and moved to live-site protection (with a grace period and a heads-up, never a surprise bill). Protection follows the domain's actual state, not whatever box it was ticked into at signup.
Residual value, protected properly
Idle domains often carry real link equity — hundreds of old referring domains pointing at them. Left on registrar parking, that equity monetizes for the registrar, on a page covered in their ads, under your name. We park domains properly: your domain, your controlled hold page or a deliberate 301 you own — no third-party ads, no takeover surface, equity preserved for when the domain goes live.
Portfolio-scale by design
Checking one domain is free and takes ten seconds — run it now on anything you own. The product is the estate version: every domain you own, watched hourly, with an Estate Health Report as the onboarding deliverable. Portfolios of thousands are the normal case for us — we run this on 2,444 of our own.
The moving parts, in plain terms
Three names, one job each. Everything on this page is commentary on these.
Idle Domain Protection
A standing watch over every domain you aren’t using. Dangling DNS records, hijack serving, spam-wave pre-poisoning and registry-state drift get caught as they happen — not months later when a scam redirect or a poisoned name surfaces in someone else’s report.
The edge
What a protected parked domain sits behind. It serves a neutral, non-indexed hold page and nothing else: every toxic URL the spam graph points at it hits a 410, and hostile crawlers get The Tarpit. No ads, no monetization, no takeover surface — the name stays clean for when you want it.
Estate Health Report
Your starting picture. Every domain you own, swept and classified: what’s live, what’s idle, what’s already compromised, and what’s quietly pointing at infrastructure you no longer control. The same sweep that found 56 hijacked domains in our own estate, run over yours.
Get early access
Leave your email — and optionally the domain you most want watched — and you're on the list. If our free checker flags anything on your domains in the meantime, you'll hear about that first.
One email when your cohort opens — no drip campaign, no resale. Requests are logged (email, site, IP) for security and outreach.
Keep reading: how SEO Sink protects your website · pricing · protect a parked domain — setup guide