Findings · 2026-08-21 · By VSNARY | Emmanuel Orta
A parking page with 783 words, and why thin-content checks cannot catch it
Scanners grade parked domains as if they were sites. The obvious fix — flag pages with almost no text — fails, because commercial landers are not thin. What works is identifying the operator serving the page.
A scanner pointed at a domain that is parked will produce a grade. Every check will run, every section will score, and the report will describe a page that nobody built — confidently, and in detail.
We had this gap. Our scanner already refuses to grade a site that answers a challenge page, on the principle that a refusal is not a measurement. But it would happily grade a domain-sale lander, because a lander is a real page that returns a real 200 with real content.
This is not hypothetical for us. One of our own domains lapsed once and served a parking page for a period. A scan during that window would have handed us a grade for a page belonging to the registrar.
The heuristic that does not work
The obvious detector is thin content: a parking page is mostly nothing, so count the words and flag anything nearly empty.
We tested that against a live parking page — a HugeDomains sale lander on a domain in our own product niche:
| Request | Bytes | Visible words |
| Parking lander, browser identity | 43,891 | 783 |
| Parking lander, GPTBot identity | 43,891 | 783 |
| Real site on a rebuilt expired domain (control) | 68,518 | 1,341 |
783 words. Not an empty page — a full commercial page with navigation, an FAQ, a price, a payment-plan offer, contact details and a search box. Any threshold low enough to catch it would flag a large number of legitimate small business sites, which routinely sit in the same range.
Note also that the lander returns identical bytes to a browser and to a named AI crawler. There is no cloaking to detect, no difference to exploit. It is the same page for everyone.
What does work: the operator, not the page
A parking page is not written by the domain owner. It is served by an operator, and the operator leaves its name in the markup — in a script host, an asset path, a form action, a link. That marker is present because the operator put it there for its own purposes, and it is absent from every page that is not one of theirs.
So detection runs in three tiers, most specific first:
- Operator fingerprints. Fifteen unambiguous markers — HugeDomains, ParkingCrew, Sedo, Bodis, Park Logic, Afternic’s for-sale path, Dan.com, CashParking and others. A single match is sufficient, because these strings only appear when that operator is serving the page.
- Default server pages. The Apache2 Ubuntu default page, the nginx welcome page, the IIS default. These are a different cause with the same consequence: a live 200 with no site behind it. We label them placeholder rather than parking, because the distinction is real and the owner’s next action differs.
- Sale copy plus an empty page — both required. Phrases like “this domain is for sale” only count alongside a page under 120 visible words. Neither signal fires alone.
The false positive this must never produce
Buying an expired domain and building a real site on it is a common and entirely legitimate practice. Such a domain is often still listed for sale somewhere, because the owner left the listing up or the marketplace kept the record.
Our control is exactly that case: a 58-engine reference site, 1,341 words of original content, running on a domain that a technology profiler still flags as listed with a domain marketplace. It carries zero operator markers, because no operator is serving it — the owner is.
That is why the rule is written against what the origin actually serves, never against what a third party says about the domain. A listing is a fact about a marketplace. A lander is a fact about the response. Only the second one is ours to measure.
Refuse, do not score zero
When the detector fires, the scan stops and returns no grade at all:
{ "parked": true, "kind": "parking", "served_by": "HugeDomains",
"words": 37, "grade": null, "overall": null }A zero would be a claim about a site. There is no site. The report says what the domain served, names the operator, and stops — the same discipline applied to challenge pages and to components that could not be measured.
It also returns in about three seconds instead of running a full scan, because there is no reason to send thirty more requests at a page belonging to a registrar.
What transfers
- Check who is serving before you grade what is served. Provenance is cheaper and far more reliable than content heuristics.
- Word count is a weak proxy for emptiness. Commercial landers are not thin. A 783-word page can contain nothing about the business you were asked to measure.
- Require two markers for anything inferred. Any signal a legitimate site might also emit — sale copy, a short page — needs a second independent one before it is allowed to accuse.
- Not measurable is a valid result. The alternative is a number that is precise, reproducible, and about the wrong page.
Method
Word counts are visible text after removing script and style blocks, tags and entities, counting alphabetic tokens of two characters or more. Both identities were sent with redirects followed, from outside the networks serving the sites. The detector runs against the homepage response body immediately after it is read, before any scoring stage.
Every figure above came out of this scanner.
Point it at your own domain and see the same measurements, free.