On LinkedIn
Contoso has been paying rent since 1998.
Not a real company. Real domain, real renewal, real money, every year since. Someone decided that was worth paying for.
If you ever sat a Microsoft exam or watched a product demo, you have met the neighbours. Contoso. Fabrikam. Tailspin Toys. Northwind Traders. Companies that never existed, and that taught you more than the documentation ever did.
A placeholder feels harmless precisely because it is not real. Then somebody bought third-party[.]com. It is the domain equivalent of Contoso, and it sits in more than 1,700 public code repositories, in AI agent instructions, in documentation nobody has reread in years. The new owner serves Windows visitors a copy-paste malware trick, and everyone else a polite “sorry, not supported”.
Scan the file, check the domain, conclude it is fine, and be completely wrong. Nobody along that chain picked it. It arrived in a doc, got copied into the next, and by the time it reached your config it was simply what everyone used. That trust was inherited, never granted.
Three domains in the world are actually reserved for pretending: example.com, .net and .org. That is the whole list.
Which is why I ran whois on the classics. Contoso, Fabrikam, Tailspin Toys: all registered to Microsoft Corporation, on Azure DNS, held since 1998. Microsoft has quietly paid for twenty-eight years of make-believe. Turns out someone in Redmond thought this through.
A placeholder is a blank cheque written against the future. You pick the name precisely because it belongs to nobody, and fiction without an owner eventually gets one.
Every trade has its Contoso. The dummy customer in the CRM demo, the test IBAN, the placeholder clause nobody ever replaced. Which one is still sitting in your live systems, and who owns it now?
The story, via The Hacker News.
The research is Manifold Security’s. They also found thirteen more placeholder domains nobody ever reserved: acme.com, company.com, vendor.com, mycompany.com, yourdomain.com, yoursite.com, foo.com and the rest of the family. Two of them already serve scareware to macOS visitors and a harmless parking page to everyone else.
So if you do want something to do with this: that list is a grep waiting to happen. Start with your docs, your agent skills and any config template older than you remember writing.