Documentation examples such as your-domain.com and yoursite.com are being used in malvertising campaigns, researchers at Manifold Security say. The practical warning is simple: a harmless-looking placeholder copied from code, documentation or an AI agent skill may now lead some visitors towards scams rather than a blank page.
Watch Desk analysis
What happened
In a report published on 24 September, Manifold Security says it found unreserved placeholder domains appearing in hundreds of thousands of GitHub files and agent skills. Researchers say those domains typically show ordinary parked pages or adverts, but use cloaking to redirect some macOS visitors to technical-support scareware and investment-fraud sites.
The researchers say the campaigns ultimately funnel traffic into affiliate programmes, including programmes associated with McAfee. Their account says most visitors see benign-looking content, which helps the domains remain inconspicuous while selected visitors receive the more dangerous redirects.
Why it matters
Placeholder domains are designed to be copied, ignored and forgotten. That makes them unusually effective camouflage for software examples, tutorials and AI-generated instructions. A developer, student or curious reader can encounter one without any reason to suspect that the domain has been registered and repurposed.
The risk is not confined to people who visit a suspicious advert deliberately. If an example URL is pasted into a browser, a cloaked redirect can decide what appears next based on the visitor, device or other signals. That turns a bit of boilerplate into a small but real security hazard, with the browser doing the travelling and the scam doing the sales pitch.
Our read
Manifold Security’s findings deserve attention because they connect a familiar software habit with a concrete abuse pattern: unreserved example domains can become delivery points for scams. The report does not establish how widespread successful infections or financial losses are, and its supplied account does not provide a complete list of affected domains or a universal test for identifying every redirect.
For readers, the useful rule is to treat placeholder domains as untrusted links. Do not assume that your-domain.com or a similar example address is safe merely because it appears in documentation, a repository or an agent skill. Check the destination before following it, avoid downloading support tools offered by unexpected pages, and close pages that demand payment or urgent technical intervention. The old advice to replace example values before shipping code has acquired a slightly less charming companion: do not casually visit them either.
What to watch
- Whether domain registrars suspend the reported placeholder domains or related infrastructure.
- Whether browser and security vendors publish detections for the cloaking and redirect patterns.
- Whether GitHub, agent-skill directories and documentation platforms warn against live placeholder URLs.
- Whether researchers identify affected Windows, Linux or mobile visitors in addition to the macOS users described here.
Discussion spark: Should documentation platforms and code hosts proactively block or warn on live placeholder domains, or would that create too many false alarms for legitimate examples?
Sources and evidence
- Placeholder Domains Whose Ads Serve Scams (24 September 2026, 06:55 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.