Placeholder Domain ‘third-party.com’ Hijacked to Deliver Fake Cloudflare Checks and PowerShell Payloads

Security researchers have uncovered that the generic domain "third-party.com," frequently employed as a placeholder in software documentation and code snippets, is now serving a counterfeit Cloudflare verification page designed to coax Windows users into executing PowerShell commands.

The malicious page mimics the familiar Cloudflare challenge, displaying a banner that claims the visitor must confirm they are not a bot. Instead of the usual JavaScript check, the page presents a short PowerShell snippet and instructs users to copy and paste it into a command prompt, alleging that doing so will complete the verification.

Placeholder domains like third-party.com have long been a convenience for developers who need a syntactically valid URL without exposing a real site. Because the address resolves to a real IP address, it is often left unregistered or pointed to a generic hosting service. Attackers have exploited this habit in the past, repurposing such domains to host phishing pages, malware loaders, or ad‑injection scripts. This latest campaign builds on that pattern, leveraging the trust that developers place in the domain to bypass casual scrutiny.

When the PowerShell command is run, it downloads and executes a second-stage payload from a remote server. Early analyses suggest the payload can install a backdoor, exfiltrate files, or drop ransomware, depending on the attacker’s objectives. Because the instruction appears in the context of a security check, victims may be less likely to question its legitimacy, especially if they are already troubleshooting a blocked site.

Experts advise users to treat any unsolicited command line request with suspicion, even if it appears on a page that looks like a legitimate security verification. The safest practice is to avoid executing code copied from web pages unless the source is verified, and to rely on built‑in browser protections or official Cloudflare tools for verification challenges. Organizations are also urged to replace placeholder URLs in internal and public documentation with non‑resolvable examples or clearly marked dummy domains that cannot be registered.

The discovery underscores a broader challenge in software development: the reliance on real, reachable domains for illustrative purposes creates an attack surface that can be weaponized. Security communities are calling for better guidelines, such as using reserved top‑level domains like .example, or employing local host entries during documentation testing. As the incident gains visibility, it is likely to prompt both developers and platform providers to reassess how placeholder domains are managed to prevent future abuse.