lux24[.]biz

Analysis of lux24.biz indicates active phishing infrastructure designed to deceive users through a fake CAPTCHA prompt. The domain, registered on April 22, 2022, through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to 91.206.71.131, hosted by Walker Web Development Services in the Netherlands. Infrastructure analysis reveals Cloudflare nameservers (cody.ns.cloudflare.com, jamie.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), which may be leveraged to lend false legitimacy to the operation. The page title, 'Вы не робот?' (translated as 'Are you not a robot?'), suggests an attempt to mimic a CAPTCHA verification process, a common tactic to harvest credentials or deliver malware under the guise of security checks. As of July 12, 2026, the domain remains active, returning an HTTP 200 status, and is flagged by at least one security blocklist. Five of 91 security vendors on VirusTotal detect the domain as malicious, though the specific payload or target brand remains unconfirmed. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. Defenders should treat this domain as part of a broader phishing campaign, particularly given its persistent activity since 2022. Recommended actions include blocking the domain and IP at network perimeters, monitoring for related indicators of compromise, and alerting users to the risks of interacting with unsolicited CAPTCHA prompts. Further investigation into the hosting provider and registrar may yield additional takedown opportunities.