Two placeholder domains that appear in hundreds of thousands of code and documentation files, including 349 AI agent skills, can route visitors to scam pages, according to research by AI agent security company Manifold Security shared with Hackread Saturday. The domains, yoursite.com and your-domain.com, are not reserved for documentation use, so anyone can register them.

What Happened

Manifold counted roughly 359,000 GitHub files referencing the two domains between them, along with 349 skills written for AI agents. It then visited both domains in 24 sessions using real browsers. Twenty of those visits landed on parking pages or ordinary advertising, one hit a Cloudflare challenge and one failed to load. The remaining two reached scam pages, and both were on macOS; the Windows and Linux sessions showed no scams.

One of the macOS sessions displayed a fake "MacOS Security Center" alert claiming the machine had four viruses and pushing a counterfeit McAfee renewal at a 55% discount, with tracking that passed through prosecutoralliance.com. The other showed a fake ZDFheute news article promoting an investment scheme, and later visits produced a fake BBC News page. Manifold said the pages ran obfuscated JavaScript that fired tracking pixels and sent visitors through affiliate chains, a setup consistent with collecting fraudulent referral commissions.

RelatedClaude Code Desktop Preview Flaw Could Have Exposed Developers’ Cloud Keys, Researchers Say

The researchers' static checks, including registry RDAP lookups, blocklist history and 52 probe requests using different user-agent strings, found nothing suspicious. According to the report, the redirect appears only after JavaScript runs in a real browser, and the final destination is assembled from URL parameters at that moment.

Why It Matters

Placeholder URLs used to be a documentation nuisance: a human reader recognizes yoursite.com as a stand-in and skips it. AI agents that load skills and follow the links inside them do not always make that distinction, and neither do automated tools that fetch every URL in a repository. That turns dead sample links into a route by which whoever controls the domain can feed content to an agent or a developer.

The finding also exposes a gap in how skills and documentation are vetted. A scanner that checks a domain's reputation or fetches it once without a full browser would have cleared both domains. The malicious behavior depends on client conditions, here the operating system, and on code executed at runtime, which static review does not see.

Context

Manifold disclosed on Sept. 23 that another unreserved placeholder, third-party.com, had been turned into a ClickFix lure. The Hacker News reported that domain appeared in more than 1,700 public GitHub repositories, many of them agent skills and MCP server documentation, and that Windows visitors were shown a fake Cloudflare check that loaded PowerShell commands onto the clipboard. Manifold said it identified 13 more non-reserved placeholder domains with similar abuse patterns.

The Internet Assigned Numbers Authority reserves example.com, example.net and example.org, along with the .example top-level domain, precisely so that documentation can use them safely.

What to Watch

Maintainers of skill registries and agent frameworks may start scanning submissions for unreserved placeholder domains and rejecting them. Manifold advised developers and AI tools that rely on older documentation to treat such URLs with caution. Watch for whether the owners of the flagged domains are identified, and whether more of the 13 domains are shown serving malware rather than affiliate scams.