Open redirect
An app redirects to a user-supplied URL without validating it, so a trusted link quietly delivers the victim to a domain the attacker owns.
redirect_uri = attackerFor years this domain lived inside security tutorials and proof-of-concept exploits — the placeholder address where a stolen token was supposed to land. It was never registered. Now it is.
Which means real requests still arrive: old copy-pasted PoCs, forgotten test configs, and genuinely broken deployments occasionally send their traffic straight here. So the one thing this site does is refuse to be what the tutorials assumed it was.
It's the shorthand security writing uses for any destination the attacker owns, where a vulnerable app can be tricked into sending data or a victim into landing. The same phrase shows up across very different bug classes:
An app redirects to a user-supplied URL without validating it, so a trusted link quietly delivers the victim to a domain the attacker owns.
redirect_uri = attackerA permissive redirect_uri lets the authorization code or token be delivered to the attacker’s endpoint instead of the real client.
code → attackerPassword-reset links are built from the incoming Host header. Poison it, and the reset token emails itself to the attacker’s domain.
reset token → attackerThe server is coaxed into making a request to an attacker-chosen address, leaking internal responses or metadata outward.
server → attackerInjected script beacons cookies or DOM secrets to a collection endpoint — classically written as this exact placeholder domain.
document.cookie → attackerA misconfigured proxy_pass forwards live login traffic to an upstream the attacker controls.
proxy_pass → attackerIf you're seeing traffic to attacker-controlled-site.com in your logs, or landed here from a redirect, something in your stack is treating a tutorial placeholder as a real destination. Worth checking:
attacker-controlled-site.com — it's almost always leftover PoC or example code.redirect_uri / return-URL allowlist for OAuth and login flows.Host header.proxy_pass targets and any outbound-fetch (SSRF-prone) allowlists.This site keeps none of it, but your logs might have — treat anything that reached here as potentially exposed and rotate accordingly.
Writeups, advisories and documentation where this domain stood in for the attacker. No blame intended: everyone needs an example domain. The point of this project is that it should not have been a registrable one.
proxy_pass → /login · source · verified 2026-07-24reverse-proxyHost header · source · verified 2026-07-24host-headerpassword reset link · source · verified 2026-07-24account-takeover/beacon · source · verified 2026-07-24header-exfiltrationEvery entry was fetched and checked against the live page on the date shown. This list is certainly incomplete — the domain is easy to write and hard to search for.
There are names reserved for exactly this purpose, and nobody can buy them.
RFC 6761 reserves .example, .test, .invalid and.localhost. IANA reserves example.com, example.net andexample.org. A payload pointed at attacker.example makes exactly the same point as one pointed here — with the difference that attacker.example can never resolve to somebody's server.
Never put a registrable domain in documentation, sample code, test configuration or a security payload. That is the whole rule.
On placeholder domains, references that outlive the systems that created them, and what it is like to own the address from the tutorial.
SPF includes, OAuth callbacks, webhooks and package metadata all name domains. Some of those names are no longer controlled by anyone you trust.
attacker-controlled-site.com sat in advisories and documentation for years while staying publicly registrable. What I found, and what I chose not to build.
evil.com has been registered since 1995, hacker.com since 1994. We checked eighteen placeholder domains from security writing. All eighteen are owned.
Standards reserve four names so documentation never points at a domain someone can buy. What to use instead, and the places people forget.