login[.]captcha-verifications[.]click

On July 24, 2026, the domain login.captcha-verifications.click was observed to host a credential‑phishing page whose HTML title reads “Telegram: Join Group Chat”. The site was provisioned on May 02, 2026 and registered through Dynadot, LLC. DNS resolution points to the Cloudflare address 104.21.80.57, an IP registered to Cloudflare, Inc. in Canada. The domain’s authoritative name servers are huxley.ns.cloudflare.com and ligia.ns.cloudflare.com, indicating that the infrastructure is hosted behind Cloudflare’s network. TLS termination uses a Let’s Encrypt certificate (issuer E7), and HTTP responses include HSTS, Bootstrap and Nginx headers, suggesting a standard web stack.

Reputation data shows the domain appears on a single security blocklist and is listed as blocked by the PhishDestroy service. Gridinsoft assigns a trust score of 0 out of 100. VirusTotal analysis records ten of ninety‑one scanners flagging the domain, reinforcing the malicious assessment. The overall risk level is classified as elevated.

At the time of reporting the domain is offline, consistent with the “taken offline” status noted in the intelligence feed. While the page title references Telegram, no further content analysis is available, and the exact phishing lure or credential collection mechanism remains undocumented. Defenders should continue to block the domain at perimeter filters, monitor for any re‑registration attempts, and update URL‑filtering feeds with the observed indicators, including the IP address 104.21.80.57, the Cloudflare name servers, and the Let’s Encrypt certificate fingerprint. Additional investigation of traffic patterns toward the IP may reveal whether the infrastructure is shared with other malicious actors.