September 26, 2026
The Placeholder Domain That Became a ClickFix Trap
Manifold Security wrote that the third-party.com domain, which frequently appears in developer documents, offered a fake Cloudflare…
By Ali Ardal
2 min read
Manifold Security wrote that the third-party.com domain, which frequently appears in developer documents, offered a fake Cloudflare ClickFix bait to Windows browsers; BleepingComputer confirmed it.
Manifold Security researcher Ax Sharma wrote on the company blog on 23 September 2026 that the third-party.com domain was serving a ClickFix lure to Windows browsers via a fake Cloudflare verification page. BleepingComputer independently verified the page the same day; The Hacker News summarized the findings on 24 September.
What is confirmed?
The third-party.com domain has been used for years in documentation as a placeholder for "an external service." It plays the same role as example.com, but unlike example.com it has not been reserved by IANA for documentation purposes. According to Manifold, the domain has been serving a ClickFix lure to Windows user agents since at least June 2026, while returning a misleading "operating system not supported" page to macOS and Linux. During BleepingComputer's testing, the second-stage domain (elxxvvx.xyz) could not be resolved; a May 2026 VirusTotal record shows the same chain pointing to an update2.zip path. Both Google Safe Browsing and VirusTotal flag the domain as malicious.
A public code search finds the domain in more than 1,700 GitHub repositories, AI agent skills, and MCP server documentation. It is also referenced as a placeholder in Chromium, Sanity and Vercel examples, as well as in W3C specifications. Manifold notes that the domain was registered in 1996 and found no evidence that it was originally acquired with malicious intent. At the time of writing, no verified reports of developer infections originating from documentation copies appear in primary sources.
How does ClickFix work here?
According to the account, Windows visitors are shown a fake "security verification" page. The page writes a PowerShell command to the clipboard and directs the user to press Win+R, paste, and hit Enter. The command is designed to run a remote script in memory. macOS and Linux user agents do not see the lure, so Linux data-center browsers may receive a clean page. This text does not reproduce the exploitation steps or the command sequence; details are available in the Manifold and BleepingComputer articles.
Manifold reported that it is also tracking 13 additional placeholder domains that are not reserved by IANA. According to The Hacker News, two of them — yoursite.com and your-domain.com — can serve scareware or scam content to macOS visitors while presenting ordinary parking pages to other browsers.
What can developers and teams do?
The primary article recommends using only the IANA-reserved domains example.com, example.org, and example.net in documentation and testing, and scanning code, skills, and MCP documentation for third-party.com and similar uncontrolled placeholders. Adding a live domain to a "known-good" list increases risk rather than protection when the content changes.
References