captcha3[.]top

On 24 July 2026 analysts observed the domain captcha3.top being hosted at IP 64.52.80.101, an address allocated to AS399629 BL Networks in the United States. The domain was registered on 26 November 2025 through NiceNIC International Group Co., Limited and currently resolves to the same IP without an SSL certificate. DNS resolution is provided by Cloudflare nameservers harlan.ns.cloudflare.com and lisa.ns.cloudflare.com. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of reputation. The site appears on a single security blocklist and has been actively blocked by PhishDestroy.

VirusTotal analysis shows that three of ninety‑five scanning engines flagged the domain, confirming a malicious classification despite the low detection ratio. The HTTP response delivers a generic “Welcome to nginx!” page title, offering no visible branding or functional content. The intelligence tags the activity as a brand impersonation targeting x.com, matching the declared scam type of brand impersonation. The domain’s current operational status is offline, and no TLS certificate was observed, which limits encrypted traffic inspection but also suggests the operator may have taken the site down. Evidence gaps remain: no concrete payload, phishing page, or credential‑harvesting infrastructure has been captured, and no additional threat‑intel feeds are referenced.

Defenders should continue to monitor the IP address and associated Cloudflare nameservers for re‑activation, add the domain and IP to blocklists, and enforce outbound filtering for traffic to captcha3.top. Because the domain lacks SSL, any future re‑deployment would be observable in clear‑text HTTP logs. Correlation with other observed x.com‑impersonation campaigns may reveal shared infrastructure. Ongoing vigilance is recommended to detect any resurgence.