captchabol[.]app

The domain captchabol.app is currently flagged as a brand‑impersonation site targeting Discord. The page title observed during the last crawl was "Captcha.bot - Verification done right," which does not reference Discord directly but the intelligence set classifies the site as impersonating the Discord brand. Gridinsoft assigns a trust score of 0 out of 100, indicating a highly suspicious reputation. VirusTotal analysis shows that 5 of 95 security vendors have flagged the domain, providing independent confirmation of malicious activity. AlienVault OTX lists the domain in two separate threat‑intel pulses, further corroborating its use in malicious campaigns. The domain appears on one security blocklist and is actively blocked by the PhishDestroy service, demonstrating that at least one defensive feed has already taken protective action.

Infrastructure analysis reveals that captchabol.app resolves to the IP address 104.21.69.187, which belongs to AS13335 owned by Cloudflare, Inc., and is geolocated in the United States. The authoritative nameservers are aron.ns.cloudflare.com and felicity.ns.cloudflare.com, both Cloudflare‑managed, indicating that the attacker is leveraging Cloudflare’s DNS and CDN services to obscure the true hosting environment. No SSL certificate is presented for the domain, meaning HTTPS connections are not available, which may affect the site’s credibility but does not mitigate the impersonation risk. The domain was registered through Cloudflare, Inc., a common registrar for fast‑deployment malicious sites.

As of the report date, July 24, 2026, the domain is listed as taken offline, which may be a temporary takedown or a shift to a new infrastructure. Defenders should continue to block the domain at network perimeter and proxy layers, add the IP address 104.21.69.187 to deny lists, and monitor for any re‑registration or rapid DNS changes that could indicate a resurrection of the campaign.