Placeholder Domain third-party[.]com Now Serving Malicious Content Across 1,700+ Repositories

The domain third-party[.]com, commonly used as a documentation placeholder, has been observed serving a ClickFix lure to Windows browsers while displaying a harmless decoy to other users.

The domain appears in references across more than 1,700 repositories.

Research Commentary

“third-party[.]com has been a generic documentation placeholder for years, the same role example.com plays,” said Manifold Security’s Head of Research, Ax Sharma.

“Unlike ‘example[.]com,’ third-party[.]com…”