The domain third-party.com, used for years as a stand-in address in developer documentation and code samples, is serving a fake Cloudflare check that tries to get Windows visitors to run a PowerShell command. Manifold Security disclosed the finding on Sept. 23, and BleepingComputer and The Hacker News confirmed the behavior.
Manifold security engineer Swapnil Patil spotted it while reviewing public AI agent skills and MCP server documentation. One of those files referenced third-party.com, and Manifold’s monitoring had flagged the domain as a phishing indicator. A documentation placeholder tripping a malware alert made no sense, so he checked what the site was actually serving.
“third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,” Ax Sharma, Manifold’s head of research, wrote. “A public code search turns it up in skills, MCP-server docs, and over 1,500 files across 1,700+ repositories from names as trusted as Chromium, Sanity, and Vercel. Since at least June 2026 it’s been serving the ClickFix lure.”
What visitors see
A browser that identifies as Windows gets a page titled “Performing security verification,” dressed up as Cloudflare. Clicking the “Verify you are human” box copies a command to the clipboard, and the page tells the user to press Windows key + R, paste with Ctrl+V and hit Enter. Manifold said the deobfuscated command pulls a script from elxxvvx[.]xyz/f and runs it in memory, with errors suppressed so the victim doesn’t notice anything.
Mac and Linux visitors get a near-identical page that stops at an error: “macOS is not supported. This website requires a Windows PC to access.” That split is why a quick look from a Linux server finds nothing wrong. “The attacker only shows the weapon to the targets it works against,” Sharma wrote.
When BleepingComputer tested the page, elxxvvx[.]xyz no longer resolved, so the chain was broken for the moment. A VirusTotal scan from May 2, 2026, showed the site had earlier handed out a PowerShell script that downloaded a 131MB zip file, update2.zip, which is no longer available, so what it installed is unknown. VirusTotal and Google Safe Browsing now list third-party.com as malicious, The Hacker News reported.
Why a placeholder could be taken
Domains such as example.com, example.net and example.org are reserved by the Internet Assigned Numbers Authority for documentation and can’t be registered. Third-party.com is an ordinary domain, first registered in 1996, whose owner controls its content. BleepingComputer said it has not determined when or how control of the site changed, and that there have been no reports of the documentation references actually leading to ClickFix infections.
The references are real, though. BleepingComputer found the domain in the W3C Geolocation and Compute Pressure specifications, in Chromium’s Telemetry Extension API docs and in a PrivacyCG proposal that uses it as the target of a JavaScript fetch() call. Code copied from samples like these could send a browser or an automated tool to the live site. Manifold said it reported the domain to its registrar, Network Solutions, before publishing.
Manifold has since found 13 more unreserved placeholder domains, including yoursite[.]com, your-domain[.]com, mycompany[.]com and acme[.]com. Two of them, yoursite[.]com and your-domain[.]com, were serving scareware and investment scams to macOS visitors and a parking page to everyone else, according to The Hacker News.
The fix researchers recommend is simple: audit documentation, skills and test code for plausible-sounding placeholder domains, and use only the reserved example.com, example.org or example.net in new material.
WebProNews is an iEntry Publication