captcha-bot[.]life

This domain, captcha-bot.life, is identified as a credential theft phishing site designed to harvest user login credentials through deceptive means. Analysis indicates no direct association with known brand impersonation or crypto drainer kits, but the infrastructure and page design suggest a focus on tricking users into submitting sensitive information under the guise of a CAPTCHA verification process. The site employs no overt branding, relying instead on generic social engineering tactics to exploit user trust. Infrastructure analysis reveals the domain was registered on March 28, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, a registrar frequently observed in malicious campaigns. It resolves to the IP address 188.114.96.3, which is associated with Cloudflare services, a common obfuscation technique to mask hosting origins. At the time of assessment, the domain is flagged by 3 out of 95 security vendors on VirusTotal, with a Gridinsoft trust score of 0/100. It appears on one security blocklist and is currently classified as offline. Detection engines such as PhishDestroy have previously blocked access to this domain. The domain has been taken offline, likely in response to security vendor interventions or hosting provider actions. However, the elevated risk persists due to the domain's recent registration and the use of bulletproof infrastructure. Users are advised to treat any prior interactions with this domain as compromised and to monitor accounts for unauthorized access. Organizations should update blocklists to include this domain and its associated IP address to prevent future exposure. Continuous monitoring of newly registered domains under the same registrar is recommended to identify potential resurgence or related threats.