testlists: semi-automatically detect and remove domains that are now for sale (aka parked domains)

[bassosimone]

While doing #1707, I came across domains that are now for sale.

Here are some examples:

1. http://makemodel.net/

2. http://www.kamayutmedia.com/

3. http://zheg.nastie.co.uk/

In general, it's not so easy to spot them, though I noticed them because they are some of the websites for which the old and the new TH report very different body sizes due to encoding.

Based on chat I had today with @agrabeli, we definitely want to remove those domains from the test lists.

[ainghazal]

there's this tool, but the results are not very good: https://github.com/gr3atest/excludeparked
there're some perhaps useful heuristics & experiments by someone at cisco: https://umbrella.cisco.com/blog/discovery-of-new-suspicious-domains-using-authoritative-dns-traffic-and-parked-domains-analysis

I think this definitely calls for crowdsourced curation. after a few suspicious -> verified signals, perhaps templates for common domain parkers can be identified based on page structure.

[ainghazal]

this paper from 2015 trains a classifier with several (10+) features from the page and domain: https://www.securitee.org/files/parking-sensors_ndss2015.pdf - they use an ad-hoc random forest model, which might be impractical, but some of the features might mix well into some cheaper kind of score.