Forgotten by security teams, parked domains have quietly become cybercrime's most lucrative hiding place.