The "third-party.com" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands.
https://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/
BleepingComputer
npub1pk…z6763
2026-09-23 22:46:19 UTC
Author Public Key
npub1pkrnqz97z2wckgmwglckccgg65eanvw3wpvuses7npqlvv6st06svz6763Seen on
wss://relay.momostr.pinkPublished at
2026-09-23 22:46:19 UTCEvent JSON
{
"id": "cf6f2dffba345f2fdc35f5a9cbb37720b39eca2b1ef7e821d5514927c230e431",
"pubkey": "0d873008be129d8b236e47f16c6108d533d9b1d17059c8661e9841f633505bf5",
"created_at": 1790203579,
"kind": 1,
"tags": [
[
"proxy",
"https://infosec.exchange/@BleepingComputer/117322781758096304",
"web"
],
[
"proxy",
"https://infosec.exchange/users/BleepingComputer/statuses/117322781758096304",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://infosec.exchange/users/BleepingComputer/statuses/117322781758096304",
"pink.momostr"
],
[
"-"
]
],
"content": "The \"third-party.com\" domain, commonly used as a placeholder in developer documentation and code examples, is serving a fake Cloudflare verification page that attempts to trick Windows users into executing PowerShell commands.\n\nhttps://www.bleepingcomputer.com/news/security/placeholder-domain-used-in-dev-docs-now-serves-clickfix-attacks/",
"sig": "51f18c77ee8f60e7796d7dd407520646920972b41e1ba7b3de5b2ac96c44cae56304d8758945ee0aedc3ca5df11b6af30b1f6b6b924eecb1819d0df064b8a2b0"
}