Your scanner sees parking. The buyer sees a payload.
This is a div block with a Webflow interaction that will be triggered when the heading is in the view.
If you check a suspicious lookalike from a data-centre address with a scripted client, you will often see a parking page. That result is real. It is also incomplete.
On this traffic machine, screening happens at least three times: at the front gate, at the ad feed's filter, and in the buyer's own delivery rules. The domain name does not decide the outcome. The visitor profile does.
What we captured on one PayPal typo
apypal[.]com sits on hastydns, inside the same nameserver family as the wider ~115,000-domain footprint. On 19 October 2026 we visited it many times from cloud regions, presenting as different kinds of visitor. Each visit recorded the full redirect chain.
The gate served a tiny Loading page, reloaded with a signed token and session ID, then a server-side redirect chose parking or an ad feed. The feed ran its own browser checks (language, screen size, and more). Failed checks got decoys.
Cloud addresses are screened too. A non-cloud visit the same day reached routers our cloud visits never saw. The malware path in the companion report appeared only in an ordinary browser.
Stable pipes, rotating destinations
The nameserver domains in this family were registered between 2009 and 2022. They still answered on 20 October 2026.
Routing, landing, and threat hosts were mostly registered in 2026. Several appeared within weeks of first use. The MEGA redirector was six days old. A feed server changed its hostname while keeping its address.
That split is the operational lesson. Domain-only blocklists chase the replaceable layer. Nameserver relationships, parking pools, gate fingerprints, and seller identifiers describe the durable layer.
What this means for defenders
- Do not close a lookalike on a single scanner verdict. Use several profiles: Windows abroad, Android, a real browser, non-cloud egress.
- Correlate DNS and proxy. Resolver logs show who queried the typo. Proxy logs show
?ch=1&js=, seller fields, and router paths such as/zokvisitor/. - Expect decoys. Streaming pages and search homepages are part of the filter, not proof the domain is clean.
- Separate commercial ad-tech from confirmed lures. Categorize shared click hosts. Block specific malware and download URLs after review.
The Bottom Line
Parking is what the operator shows observers. Sale is what it does with selected real users. If your tooling only sees the first, your readiness report is describing the decoy.
Details and full redirect table: technical report. Next: the macOS ClickFix path that ran on top of this machine.
Pre-Attack Prevention. Hit the source.
