A documentation placeholder nobody reserved now serves a ClickFix lure, and the request is the detection

Two counts of the same domain, published one day apart

On 23 September 2026 Manifold Security published a finding about third-party.com, a hostname that appears in developer documentation the way example.com does. The post said a public code search turns the domain up in "over 1,500 files across 1,700+ repositories". On 24 September the same firm published a follow-up with a table of fourteen placeholder domains and a stated counting method, and in that table third-party.com sits at 672 files.

Both numbers cannot be exact, and one of them is arithmetically impossible on its own terms. Every file lives in exactly one repository, so a set of matching files cannot be spread across more repositories than there are files. You cannot have 1,500 files in 1,700 repositories.

I ran the count myself against GitHub's code search API on 24 September 2026, signed in, which excludes forks by default. The bare string third-party.com returns 1,106 files. The exact literal "https://third-party.com", which is the form that would actually resolve if something followed it, returns 383 files. Paginating that second query returned 368 rows containing 277 distinct repositories.

What this does not establish. It does not establish that anybody misreported anything. GitHub describes its own code search counts as approximate, Manifold says explicitly that both of its columns are floors, and the two posts were plainly measuring different things: one a broad mention, the other a hostname written as a URL. Nor does a smaller number mean a smaller problem. Code search cannot see private repositories, vendored copies, container images, internal wikis, Confluence pages, PDF runbooks, or the copy somebody pasted into a config file in 2019 and never pushed.

What the disagreement does establish is the shape of this story. Nobody, including the people who found it, can tell you how many places this string is reachable from. The correct response to that is not a better number. It is a control that does not depend on knowing the number.

What the domain actually serves, at a defender's level

Manifold's security engineer Swapnil Patil noticed the domain when a public agent skill that referenced it tripped a phishing indicator in the firm's own monitoring. A documentation placeholder setting off a malware alert did not add up, so the team looked at what the host was serving.

Fetched with a Windows user agent, the page imitates a Cloudflare verification screen, complete with an animated checkbox and a Ray ID in the footer. Its JavaScript stages the system clipboard using a hidden text area and a hijacked copy event, then walks the visitor through opening a Windows system dialog, pasting and pressing Enter. A decoy comment and a random six digit number are appended so that what lands in the dialog reads as a verification token rather than as a command.

Fetched with a macOS or Linux user agent, the same host returns a near identical page that stops at an error saying the site requires a Windows PC. No clipboard staging. No payload. As Ax Sharma, Manifold's head of research, puts it: "The attacker only shows the weapon to the targets it works against."

The second stage the pasted command reaches for, elxxvvx[.]xyz, was not resolving when Manifold tested and was still not resolving when BleepingComputer tested. A Hybrid Analysis submission dated 2 May 2026 shows that host previously served a script that pulled a 134MB archive and tried to launch an executable named after a well known diagramming tool. That archive is gone, so what the final payload did is not established by any source I could reach.

It is a placeholder, not an abandoned project, and that is checkable

Those are different stories. An abandoned project domain that lapsed and got re-registered is an ordinary supply chain failure with a known owner and a known history. A documentation placeholder is not a dependency anybody tracks, has no owner in anybody's inventory, and reaches people who never installed anything.

This is the second kind, and four independent checks say so. I fetched each of these myself rather than taking the coverage's word for it.

Where the domain appears as a documentation example. Each file was fetched directly from its source on 24 September 2026.

Source	How the domain is used	Verified
W3C Geolocation, Candidate Recommendation Snapshot, 26 March 2026	An iframe example showing how to grant geolocation to third-party content	One occurrence, in the section on enabling the API in third-party contexts
W3C Compute Pressure, Candidate Recommendation Draft, 14 May 2026	The same iframe pattern, showing policy-controlled access for remote content	One occurrence, in the policy control section
Chromium, Telemetry Extension API README	An externally connectable match pattern for a permitted site	Line 161 of the file at the pinned commit
Vercel, Turborepo, builder.rs	A test fixture checking origin matching against a telemetry endpoint	Line 2616 at the pinned commit

The Sanity example is the one that shows how far this has travelled. The domain appears in .agents/skills/playwright-best-practices/browser-apis/iframes.md, which is an agent skill file, in a cross-origin iframe example. Manifold's own corpus surfaced three more skills carrying it, one of which uses the domain in a snippet explicitly labelled as the wrong way to hardcode an endpoint.

The archive settles the last question. The Internet Archive's capture of 21 January 2025 shows a bare Apache directory listing with a single cgi-bin/ entry last modified in January 2017. That is a dormant server, not a product that died. The capture of 15 June 2026 is the lure page. I checked the captures of 22 and 24 September 2026 myself: both are still the lure, still titled with a holding message, still carrying a Ray ID and an unsupported operating system string.

Between the dormant capture and the first archived lure there are 510 days. No source I could find states when control of the domain changed, or how. The registrar is Network Solutions and the domain was first registered in 1996, which is a quarter of a century before anybody wrote a skill file.

The correct practice has been written down since 1999

RFC 2606, published in June 1999 by Donald Eastlake and Aliza Panitz and designated BCP 32, reserves four top level domains and three second level names for exactly this problem. The top level names are .test for testing DNS code, .example for documentation and examples, .invalid for names that must never resolve, and .localhost for loopback. The second level names are example.com, example.net and example.org. The RFC's stated reason is blunt: test or example code might escape from the testbed.

RFC 6761, published February 2013 by Stuart Cheshire and Marc Krochmal, put those names into a formal IANA Special-Use Domain Names registry and set out how resolvers and authoritative servers should treat each one. IANA's own page on the example domains states the operative fact in one clause: they "are not available for registration or transfer".

That is the whole difference. example.com cannot be bought by anybody, ever. third-party.com could be bought by anybody, and at some point in a 510 day window, somebody's content started appearing on it.

How many places is it reachable from

The honest answer is that nobody can count it, and the useful answer is to describe the shape instead.

Here is my method, so you can repeat it or disagree with it. I queried GitHub's code search API on 24 September 2026 as an authenticated user, which searches indexed public code on default branches and excludes forks. I ran the bare hostname, the hostname written as a URL with a scheme, and three language filters, then paginated the URL-form query and counted distinct repository names in what came back. GitHub caps paginated results and calls the totals approximate, so these are floors, not measurements.

Counts for third-party.com. Rows one to three are my own queries against GitHub's code search API on 24 September 2026; rows four and five are as published.

Query or source	Result	What it counts
Bare string third-party.com	1,106 files	Any mention, including prose and longer hostnames
Exact literal with scheme	383 files, 277 distinct repositories in 368 rows	The form that would resolve if something followed it
By language: markdown / TypeScript / JavaScript	528 / 131 / 59 files	Where the string lives, weighted heavily to documentation
Manifold, 23 September 2026	Over 1,500 files across 1,700+ repositories	Stated without a method; arithmetically impossible as a pair
Manifold, 24 September 2026	672 files	Hostname preceded by a scheme separator, forks excluded

The shape matters more than any of those cells. Roughly half of the hits are markdown, which means the dominant artefact is documentation teaching the next person to write the same string. The TypeScript and JavaScript hits are the ones that could produce a request. And the exposure compounds in a direction code search cannot follow: a skill file that carries the line has, on Manifold's count, been forked 1,089 times, and every copy carries it.

There is also a timing point that clears the projects involved entirely. The skill lines that Manifold could date from Git history went in on 19 January and 28 February 2026, months before the lure first appears in the archive. The authors cited a dormant placeholder. The ground moved underneath them, and nothing in any repository had to change for that to happen.

The second Manifold report, published on 24 September, is the one that resets the scale. Sweeping for placeholder hostnames of the same class turned up fourteen that are not IANA reserved, cited by 1,536 skills in the firm's corpus. Three of the fourteen were serving something other than examples. Measured by citations, this ClickFix case is the small one.

Selected rows from Manifold Security's table of unreserved placeholder domains, 24 September 2026. GitHub column counts files writing the domain as a URL, forks excluded, and is described by the authors as a floor.

Domain	Files on GitHub	What it served when looked at
foo.com	333,312	Not stated
yourdomain.com	195,072	Not stated
yoursite.com	about 185,000	Investment fraud, to macOS visitors, via a parking page ad chain
your-domain.com	about 174,000	Scareware and investment fraud, to macOS visitors
acme.com	81,536	Not stated
third-party.com	672	ClickFix lure, to Windows visitors only

The two scam cases are worth a defender's attention for a reason that has nothing to do with malware. They are parked domains carrying ordinary advertising, and the scam fires after the page's JavaScript runs, one hop away on another host. Manifold rendered the pair twenty-four times in a real browser: two of sixteen macOS renders ended on a scam, none of the eight Windows or Linux renders did. Static fetches, blocklist history and user agent probing cleared all thirteen domains. If your assurance process is "we checked the domain", that is the result it would have given you.

The request is the detection, and this is the useful part

Everything above is about somebody else's estate. Here is the part that is about yours.

An outbound request from your network to a documentation placeholder domain is almost always a mistake. It means a literal example escaped review and something followed it: a browser rendering a page built from copied markup, a test fixture pointed at the internet, a container built from a config nobody read, an agent that harvested a URL out of documentation it was given and fetched it. None of those is a thing you wanted. The ownership of the domain is not the point. The request is a defect signal whether the far end is an attacker, a parking page or a friendly stranger.

That makes this rare among indicators: a near zero false positive rule that you can write once and that does not decay when the attacker rotates infrastructure, because the string on your side never changes. It also gives you something a code sweep cannot, which is coverage of the copies you do not own: the vendor appliance, the SaaS tenant, the contractor's laptop.

# 1. Sweep source, docs, skills and MCP configs for unreserved placeholders.
#    Reserved names are deliberately absent from this list: they are the fix.
rg -n --hidden -g '!.git' -iE \
  '(https?://)?(third-party|yoursite|your-domain|yourdomain|mysite|myapp|\
   your-app|yourapp|your-site|company|mycompany|vendor|acme|foo)\.com' .

# 2. Detection, in words rather than in one vendor's syntax:
#    alert on any DNS resolution or HTTP request, from any source in the estate,
#    to a hostname on that same list. Severity low, disposition "investigate",
#    expected volume near zero. Do not allowlist any of them to silence noise.

# 3. Reserved names for the fix. These can never be registered by anyone:
#    example.com  example.net  example.org
#    .example  .test  .invalid  .localhost        (RFC 2606, BCP 32)

Why a technique that needs the user to act is so hard to block

CTM360 published a 61 page report titled "ClickFix and Beyond" on 22 September 2026, marked TLP CLEAR, combining campaign level analysis across more than 3,000 compromised websites with host level analysis of a single compromised WordPress site. Its account of why the technique defeats controls that work on other delivery methods is the clearest I have read, and it is defined by absence: there is no exploit for a vulnerability scanner to find and no patch that closes it, usually no attachment for an email gateway to detonate, and no download for a browser's file reputation check to score. The command is pasted by an authenticated interactive user into a native, signed, universally present binary, which is the profile of legitimate administrative work.

MITRE now tracks the behaviour as T1204.004, User Execution: Malicious Copy and Paste, created 18 March 2025 and last modified 12 May 2026, with Linux, Windows and macOS all listed as applicable platforms. ESET recorded a 517 per cent rise in its detection for this class between the second half of 2024 and the first half of 2025.

CTM360's most useful structural observation is that everything cheap for the attacker to change is changing constantly, and everything expensive has not changed in three years. The artwork, the brand being impersonated, the keyboard shortcut and the payload family all rotate. The structure does not: a page writes to the clipboard, a user opens an interpreter, the interpreter reaches the network, something persists.

CTM360's four chokepoints, 22 September 2026, with the intervening control class as the report states it.

Chokepoint	What must be true for the attack to proceed	Control class
Clipboard staging	A web page must be able to write to the system clipboard	Browser policy
Interpreter access	An interactive user must be able to open a shell or Run dialog and run arbitrary content	OS policy, application control
Interpreter egress	That interpreter must reach the internet directly to fetch the next stage	Network policy
Post-execution behaviour	Something must persist, inject, collect and exfiltrate	EDR behavioural detection

CTM360's own prioritisation, if a team can deploy only one control this quarter, is the third: stop script interpreters and fetch utilities reaching arbitrary internet hosts directly, and force them through an authenticated proxy with an allow list. That breaks every staged chain in their report at the first hop, on all three operating systems, without depending on any indicator.

Two detection notes from the same report are worth carrying into a UK SOC. The Windows Run dialog records what was typed in the RunMRU registry key, which the report rates a very high fidelity signal with almost no false positives on a healthy corporate endpoint. Operators noticed, and a now common variant routes the user through the Power User menu into Windows Terminal instead, which leaves no RunMRU entry at all. The durable replacement is process ancestry: the desktop shell spawning PowerShell, pwsh, Windows Terminal or cmd with a long, encoded or obfuscated command line.

And on the cross-platform side, the highest value item per unit of effort is browser policy. Chrome and Edge enterprise policy can set the default clipboard site permission to block, with an allow list for the handful of internal applications that genuinely need it. The page can still display its instructions, but it cannot silently stage the command, and a user asked to retype an obfuscated one liner by hand will usually stop.

There is one line in CTM360's report that should trouble anyone running a Linux engineering estate: the population most at risk is not servers but Linux desktops used by engineers, who are habituated to installing software by pasting a command into a shell, and who typically hold cloud credentials, SSH keys and source access. The campaign CTM360 dissected had a Linux landing page built and held in reserve.

What is established, and what is not

Read against the primary sources fetched for this briefing on 24 September 2026.

Claim	Established	Not established
The domain serves a ClickFix lure to Windows visitors	Manifold's fetch, BleepingComputer's confirmation, archived captures of 15 June, 22 and 24 September 2026	What the final payload did. The second stage host was already offline when both parties tested
It is a documentation placeholder, not a lapsed project	Verified in two W3C specifications, Chromium, Vercel Turborepo and a Sanity agent skill; the January 2025 capture is a bare directory listing	Nothing suggests it was ever a product or service
Control of the domain changed hands	The archived content changed between 21 January 2025 and 15 June 2026	When, how, or to whom. No source states this. Registered in 1996 via Network Solutions
Developers have copied the examples into live code	A 2015 Stack Overflow question cited by BleepingComputer describes exactly that, before the lure existed	No reported case of a ClickFix attack actually being executed through one of these references
The documentation owners have responded	Nothing found. A GitHub issue search for the domain created after 20 September 2026 returns one result, a news aggregator	Absence of a public issue is not absence of a response; private fixes would not appear

That last row deserves a plain statement rather than an insinuation. As of 24 September 2026 I could find no published statement from the W3C, Chromium, Vercel or Sanity about this, and no public issue or pull request proposing to change the examples. That is a gap of one day and a weekend from the original disclosure, which is not long, and none of those projects did anything wrong. The examples were correct when they were written.

On commercial interest: Manifold Security sells runtime monitoring for AI agents and MCP servers, and both of its posts close by saying so. CTM360 sells external attack surface management and the ClickFix report is gated behind a download form. Neither fact weakens the evidence. I fetched the primary artefacts, the specifications, the source files, the RFCs and the archived captures directly, and the numbers I could not reproduce are flagged above rather than repeated.

What to do, in the order worth doing it

The question that exposes the gap

The reserved names have existed since June 1999 for exactly this reason, spelled out in the RFC: example code escapes from the testbed. The failure here is not that somebody chose a bad domain. It is that a string which reads like a reserved name, in a specification published by a standards body, carried none of the protection that the reading implies, and there was no point in the pipeline at which anything checked.

So the question is not whether you have third-party.com in your estate. That is a grep, and you should run it. The question is the one underneath it.

Which other strings in your documentation, your test fixtures and your agent configurations are you trusting because of how they read, rather than because somebody verified what stands behind them, and what would tell you on the day one of them changes hands?

Key facts

This analysis was researched with Claude, made by Anthropic.