A September 23, 2026 security report found that third-party.com, a real registrable domain long used as a generic placeholder in public developer examples, was serving a fake Cloudflare-style verification page associated with a ClickFix lure. That does not mean projects whose documentation referenced the hostname were compromised, but it demonstrates why arbitrary real domains are unsafe placeholders: ownership and content can change while copied examples continue to make real network requests. IANA specifically maintains example.com, example.net and example.org for documentation and says they are not available for registration or transfer. RFC 2606 also reserves .test for testing, .example for documentation/examples, .invalid for names that should be obviously invalid and .localhost for loopback use. IANA separately warns that the HTTP service on its example domains is best-effort and is not designed to support production applications or serve as a software-testing endpoint. The production rule is therefore intent-first: use reserved names for illustrative documentation, controlled organization-owned endpoints for tests that genuinely need network behavior, explicit real provider domains only when the integration actually depends on them, and network restrictions that keep copied examples from silently becoming outbound production dependencies.
Documentation or README examples use a plausible third-party hostname that the organization does not own or control
A copied sample, AI-generated skill, MCP configuration or test fixture performs a real fetch against what was intended to be a placeholder
CI, preview or developer tooling can reach arbitrary external hosts while executing examples or tests
A placeholder link unexpectedly shows a login, CAPTCHA, verification prompt, download or instructions to run local commands
Example URLs are mixed with real provider endpoints so reviewers cannot tell which network calls are intentional
Possible causes
A normal registrable domain was treated as if it were permanently reserved for examples
Documentation snippets were copied into executable code without a network-boundary review
Tests depend on an external HTTP response even though the hostname was supposed to be illustrative
AI-generated documentation or agent instructions can repeat familiar-looking example domains without checking whether they are reserved
Outbound network access is broader than the task requires, so an accidental placeholder can become a real request
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Inventory developer-facing examples, READMEs, sample environment files, test fixtures, generated docs, MCP/agent skills and onboarding snippets for external-looking hostnames. Prioritize strings inside fetch/HTTP/WebSocket commands, iframe/src attributes, webhook examples and executable configuration because copied examples can make real requests.
Step 2. Classify each hostname by intent before replacing it. For illustrative documentation that should not depend on a live third party, use IANA-reserved documentation names such as example.com, example.net, example.org or a name under .example.
Step 3. Use .test where a test-only DNS name is appropriate, .invalid when the name must be obviously non-resolving/invalid, and localhost only for loopback behavior. Follow the semantics in RFC 2606 instead of treating all reserved names as interchangeable.
Step 4. Do not turn IANA's example-domain web server into a test dependency. IANA says the HTTP service is best-effort and is not designed to support production applications or software tests; use a local mock, controlled staging service or organization-owned test endpoint when the test needs deterministic HTTP behavior.
Step 5. Keep real provider domains only when the example genuinely demonstrates that provider integration. Label them as real network destinations, avoid embedding credentials, and ensure the surrounding instructions explain that running the sample can contact the external service.
Step 6. Add an outbound-origin review to documentation and sample-code changes. A lightweight CI check can flag newly introduced http/https hosts that are neither approved real integrations nor reserved example names, with a reviewed allowlist for legitimate dependencies.
Step 7. Review AI-generated documentation, coding-agent instructions and MCP skills under the same rule. Do not assume a plausible hostname is safe because it appeared in model output, old documentation or a widely copied snippet; verify whether it is reserved or intentionally controlled.
Step 8. Constrain network access for automated tests and agents to the destinations they actually need. Where the platform supports it, deny arbitrary outbound requests by default and explicitly allow required package registries, APIs or controlled test services.
Step 9. If an example hostname unexpectedly presents a verification prompt, download, shell-command instruction or other unrelated content, stop interacting with it. Do not execute copied commands; identify the requested origin, remove the accidental dependency and review whether the page received any sensitive request data.
Step 10. After replacement, run the affected docs/tests in a controlled environment and confirm the example still teaches the intended behavior without relying on external mutable content. Keep a regression test or lint rule so the unsafe placeholder does not return later.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Prefer local mocks or organization-controlled staging endpoints when executable tests need deterministic network behavior.
Treat every newly introduced external hostname in examples, agents and CI as a dependency that needs an owner and an explicit purpose.
Keep secrets out of documentation examples and use least-privilege network access for automated tooling.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not use an arbitrary registrable domain as a placeholder merely because it looks generic or has been copied widely.
Do not assume example.com, example.net or example.org provide a stable HTTP testing API; IANA explicitly says their web service is best-effort and not for production dependence.
Do not replace a legitimate documented provider endpoint with a reserved placeholder when the purpose of the example is to demonstrate that real provider integration.
Do not execute shell commands, installers or clipboard content presented by an unexpected placeholder page in order to 'verify' the example.
Do not grant an AI agent unrestricted network access simply to make documentation examples work.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Platform scope
Developer documentation · AI coding agents · MCP skills · CI/CD · test fixtures · web/API examples
Which domains does IANA reserve for documentation examples?
IANA maintains example.com, example.net and example.org for documentation, and RFC 2606 also reserves the .example top-level domain for documentation/examples. These are preferable to made-up registrable domains when no live external service is intended.
Should I use example.com as a live test server?
No. IANA says its HTTP service on the example domains is best-effort and is not designed to support production applications or software tests. Use a mock or controlled test endpoint when the response itself matters.
What are .test, .invalid and .localhost for?
.test is reserved for testing, .invalid is intended for names that should be clearly invalid, and .localhost is reserved for loopback use. Choose the name that matches the behavior you want.
Does the third-party.com incident mean every project that mentioned it was compromised?
No. The reported issue is that a mutable real domain used as a placeholder began serving unrelated malicious content. A reference in documentation is not itself proof of compromise; investigate whether any executable code actually contacted the domain or exposed data.
Should AI-generated docs be checked for placeholder domains?
Yes. Apply the same hostname and outbound-network review to AI-generated examples, agent skills and MCP instructions as to human-written sample code.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
