com-complete-captcha[.]info

This domain, com-complete-captcha.info, operates as a credential harvesting phishing site targeting users through deceptive CAPTCHA verification prompts. Attackers use this technique to trick victims into entering sensitive login details, such as usernames, passwords, or multi-factor authentication codes, under the guise of a security check. Once submitted, the stolen credentials are typically exfiltrated to attacker-controlled infrastructure for unauthorized access to accounts, financial fraud, or further exploitation in targeted campaigns. The site’s design and functionality closely resemble legitimate CAPTCHA services, increasing the likelihood of successful deception, particularly among users who may not scrutinize domain names or SSL certificate details. Analysis indicates this domain was registered on April 22, 2026, through Global Domain Group LLC, a registrar frequently associated with malicious or high-risk domains. It is currently flagged by 21 out of 95 security vendors on VirusTotal, a clear indicator of its malicious intent. The domain resolves to the IP address 37.77.150.152, hosted by LLC Baxet in Russia, a provider commonly linked to phishing and malware distribution. Additionally, the domain appears on three security blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL, further corroborating its classification as a high-risk threat. The SSL certificate, issued by Let’s Encrypt (serial number E7), does not mitigate the risk, as attackers routinely use valid certificates to lend false legitimacy to phishing sites. Users who have visited com-complete-captcha.info or entered credentials on the site should assume their login details have been compromised. Immediate action is required: change passwords for all accounts accessed from the same device or network, enable multi-factor authentication where available, and monitor accounts for unauthorized activity. If financial or sensitive data was entered, contact relevant institutions to report potential fraud. Devices used to access the site should be scanned for malware using updated security tools, as phishing sites often deploy additional payloads. Network administrators should block the domain and its resolving IP (37.77.150.152) at the perimeter to prevent further exposure. Given the domain’s high-risk status and offline status, users should remain vigilant for similar phishing attempts, particularly those mimicking security verification processes.