TL;DR
- Manifold previously disclosed that the placeholder site third-party[.]com was turned into a ClickFix lure.
- Thirteen more placeholder domains are not IANA-reserved, so anyone can own them. We found two whose ads use cloaking to show scams to macOS visitors and an ordinary parking page to everyone else.
- These two sites, yoursite[.]com and your-domain[.]com, are present in hundreds of thousands of GitHub files and hundreds of agent skills.
- Static checks cleared every one of these domains. The redirect to the scam fires after the page's JavaScript runs, so a text fetch never sees it, whatever User-Agent you send.
Two placeholder domains, and two scams
your-domain[.]com and yoursite[.]com are placeholder domains, the kind of stand-in hostname a writer reaches for when documentation needs one. Both sit on parking services today, which is why they carry advertising at all. We rendered the two of them twenty-four times in a real browser. Twenty of those renders ended on a parking page or an ordinary ads article, one stopped at a Cloudflare challenge, and one failed to load.
Two ended on a scam. On a macOS browser, your-domain[.]com showed a fake "MacOS Security Center" claiming four viruses and selling a counterfeit McAfee renewal at 55% off. On another macOS render, yoursite[.]com showed a counterfeit ZDF news article advertising an investment scheme.
What the first disclosure established
Part I established that third-party[.]com, a documentation placeholder used across 1,700+ repositories, was turned into a ClickFix lure: a fake Cloudflare check that puts a PowerShell command on a Windows visitor's clipboard, with a decoy for everyone else.
The rest of the class carries different payloads on the same kind of documentation footprint.
Three payloads on one attack surface
We swept our corpus for every other unreserved placeholder domain of the same kind and found thirteen, cited by 1,536 skills. Then we looked at what they serve.
- third-party[.]com: ClickFix. Windows-gated. Second stage elxxvvx[.]xyz.
- your-domain[.]com: scareware, and investment fraud. Its advertising chain reached both the fake MacOS Security Center page and a counterfeit BBC News article advertising a financial scheme. Affiliate fraud rather than malware delivery.
- yoursite[.]com: investment fraud. Its macOS visitors reached a fake ZDFheute news article, built around a fabricated talk-show confrontation between two German politicians, selling an investment scheme. Other renders ended on an ordinary ads article, and one behind a Cloudflare challenge that blocks automated inspection, which remains untested rather than clean.
All three are the same class of asset with different payloads, and the two placeholder domains share an advertising account.
Both parking pages load the same ad-redirect account, and it does not send everyone the same way. Between them we reached tech-support scareware, a counterfeit BBC article and a counterfeit ZDF article, through different redirectors and different ad networks. These domains are not one campaign. They are an on-ramp into a general malvertising market, and what a visitor gets depends on who is buying that day.
The rate is low. Across sixteen macOS renders of the two domains, two ended on a scam. None of the eight Windows or Linux renders reached either one; those ended on the parking page or on an ordinary ads article. A single check clears the domain almost every time, and the destination changes between visits.
The scam page does not know where it is sending you
The scareware runs five screens: a security alert, a table of four fake viruses, a scan result, a progress bar that advances on its own, and an expiry notice with a 55%-off countdown. Only the last one has an exit, behind a Renew Now button, and if nobody clicks it the countdown fires the same exit anyway.
That exit function ships as a single line of obfuscated JavaScript. Deobfuscated, it does two things: it loads a hidden one-pixel image to register the conversion, then sends the browser on. It navigates whether the pixel loads or fails, and it clears the page's own are-you-sure exit guard on the way out.
The fragments https:// and /9rert?re5f=1&bcid= sit in an obfuscated lookup table, and the domain itself is read at runtime from the scam page's own query string with getURLParameter("domain"). The routing site put it there when it sent the victim in, along with a click ID and a billing ID. The page hands the visitor straight back to that router, prosecutoralliance[.]com, which chooses the next offer.
Scanning the page's code yields no host to block, because the page does not contain one. The operator can also rotate routing domains as often as they like without editing the page at all.
We followed one of those exits. The click ID from our earlier scan led to an affiliate click tracker, fastdltrk[.]com, and from there to a genuine McAfee landing page on mcafee.com, arriving with the affiliate-network parameters that credit a sale.
So the business model is lead generation. Fake virus warnings funnel people into real McAfee subscriptions, and someone collects a commission on each one. A scanner that follows the chain to its end lands on McAfee's real website, so every detection signal there points at a legitimate company.
That is one observation, from Germany, on a day-old click ID, and the same router feeds other scam pages, so other visitors may be sent elsewhere. Nothing suggests McAfee is a party to this. The abuse is of its affiliate program.
Every other known entrance is a lookalike domain
urlscan's public index shows at least six starting points into the scam page in the week to September 23: our your-domain[.]com alongside five bank and parcel lookalikes, among them scotiabank-secure[.]info, fedexsupportverification[.]com and lnterac-transfer-login[.]com, which swaps a lowercase L for the I in Interac. At least four of the five arrived carrying the same router in the query string that ours did.
That router feeds two further scam pages, and the redirector above it handled 95 different entry domains across a three-day sample, ending at push ads, casino offers and clickbait. Read all of these as floors: the index holds only what somebody thought suspicious enough to submit.
What the five lookalikes have in common is that each has to be marketed, pushed in front of a victim through phishing mail, ads or search placement. The placeholder domain needs none of that. It arrives through documentation people already trust, copied into thousands of repositories: the one entrance with a distribution channel the operator did not have to build.
Static checks cleared all of them
Before rendering anything, we ran the standard static checks: registry RDAP for ownership and recent changes of control, blocklist history, twenty-one years of archived page sizes, and a 52-request probe varying the User-Agent across Windows, macOS and Linux. All thirteen came back clean.
They were clean because the lure is not on these domains at all. The page you fetch is the parking page; the redirect to the scam fires after its JavaScript runs, one hop away on another host. A text-only fetch never sees that, however many User-Agents you send.
Blocklists are weaker than they look here too. A public blocklist added third-party[.]com on July 7 and dropped it ten days later, while the lure was live throughout. That is what you would expect when a page serves its lure to one operating system and a decoy to the rest: a scanner fingerprinted for one of them sees nothing from the other.
Three of fourteen unreserved placeholder domains are doing more than serving examples
The GitHub column counts files that write the domain as a URL; the skills column counts distinct skills in our corpus that cite it. The GitHub figure comes from GitHub's web code search, signed in, run on 2026-09-23, querying the hostname preceded by a scheme separator, which excludes prose mentions and substring matches inside longer hostnames. It counts files rather than repositories, and it excludes forks, which GitHub omits by default, and subdomains. The two highlighted rows are reproduced as the interface renders them in Figure 8. GitHub calls these counts approximate and they move between queries. Both columns are therefore floors.
Measured in citations, the ClickFix incident is the small case. Between them, the two placeholder domains are referenced in over 350,000 GitHub files and roughly 350 skills in our corpus. Scareware and investment fraud are a lower threat than clipboard malware, the exposure they ride on is far larger, and none of it showed up in any static check we ran.
Who is citing them
The two columns are ranked independently, so rows pair by rank and not by any relationship between the repositories. Top of a sample: 484 unique repositories drawn from the first three result pages per domain, not from all matches. No repository in the sample cited both domains.
Two of the yoursite[.]com repositories are security projects. pwnlandia/mhn is the Modern Honey Network and RoseSecurity/Red-Teaming-TTPs is a red-team reference. Security tooling is citing a domain on an advertising chain that also serves scareware.
The citation was correct when it was written
The projects that cited these domains are the victims of the change, not parties to it.
Of the affected skills we can date from git history, the third-party[.]com lines went in on 2026-01-19 and 2026-02-28, months before the domain was serving its lure, which it has done since at least June. They cited a dormant placeholder, and control of it changed hands out from under them.
Nothing in the skill has to change for that to happen. One of those skills has since been forked 1,089 times, and every copy carries the line.
We have covered this class before. Our curl | bash piece found the same shape in shell install instructions: documentation pointing an agent at a remote resource that nobody re-checks at the moment it runs.
Cite only domains you control
These pages are built for a person at a browser, and a discerning person usually evades them. The more exposed reader is an agent. Agents fetch and act on the documentation these citations live in, and while a sophisticated model may well refuse a fake renewal page, nothing here tests that. The population we would expect to be more susceptible is agents running on cheaper, smaller models tuned for speed and economy.
Stop citing domains you do not control in documentation an agent will read. example[.]com, example[.]org and example[.]net are reserved under RFC 2606 by the Internet Assigned Numbers Authority (IANA), the body that coordinates the internet's root domain names, and can never be registered by anyone. Every domain in the table above can be bought.
If you maintain a corpus, "is this domain on a blocklist" is the wrong check. The right one is who owns it now, and what its advertising chain does today, on the operating system your readers run.
References
Prior work in this investigation
Sharma, 2026. "The third-party[.]com domain is serving a ClickFix lure to Windows users." Manifold Security.
Sharma and Nash, 2026. "What to think about curl | bash now that AI agents run it." Manifold Security, 2026-08-19.
Standards
Eastlake and Panitz, 1999. "RFC 2606: Reserved Top Level DNS Names." IETF.
The ClickFix technique
Microsoft, 2025. "Think before you Click(Fix): Analyzing the ClickFix social engineering technique." Microsoft Security Blog, 2025-08-21.
Sophos X-Ops, 2026. "ClickFix campaign abuses Deno runtime for infostealer delivery." Sophos. Undated on the page; describes June 2026 activity.
