security[.]lockedcaptcha[.]com

PhishDestroy identifies active phishing infrastructure targeting CAPTCHA service users via the domain security.lockedcaptcha.com. This domain was flagged as a generic phishing page, actively impersonating a legitimate CAPTCHA verification service to harvest user credentials and session tokens. The site likely deploys a custom HTML-based drainer kit that mimics CAPTCHA input fields to trick victims into submitting sensitive data before redirecting to benign pages.

This domain resolves to IP address 188.114.97.3 and currently shows 0 detections out of 95 engines on VirusTotal. The domain was registered through Fewmoretaps OU d/b/a Trustname.com on April 19, 2026, and secured with a Let’s Encrypt SSL certificate. As of assessment, the domain remains unlisted on Google Safe Browsing and has not been widely blocked, increasing exposure. Risk remains active due to low detection coverage and fresh registration, suggesting a newly deployed campaign.

The domain is currently classified as active with a risk status under investigation. Security teams are advised to block both the domain and associated IP at the network perimeter. Users should avoid interacting with any CAPTCHA prompts linked to this domain or similar unverified services. Remaining risk is assessed as moderate pending further takedown or detection updates. Monitor for associated domains or subdomains from the same registrar or infrastructure. Full technical indicators and mitigation steps are available in the detailed report.