captcha-load[.]netlify[.]app

Analysis of captcha-load.netlify.app indicates that the domain was registered on February 21, 2026 through Name.com, Inc. and is hosted on Amazon's infrastructure (AS16509) in Germany, resolving to the IPv6 address 2a05:d014:58f:6200::258. The site presents an HTTP 404 response with the page title "Site not found," suggesting that the malicious content has been removed or the site is currently offline. Despite the absence of active content, the domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, reinforcing its classification as a phishing‑related indicator.

The SSL certificate in use is issued by DigiCert Inc., specifically the DigiCert Global G2 TLS RSA SHA256 2020 CA1 certificate, and the hosting environment reports Netlify technology with HTTP Strict Transport Security (HSTS) enabled. VirusTotal records show that the domain was scanned by 93 vendors, none of which currently flag it; however, the lack of detections does not constitute evidence of safety, particularly given the domain's prior blocklist presence. At present, the site is offline, limiting immediate threat exposure, but the infrastructure—namely the Amazon‑hosted IPv6 address and Netlify deployment—could be reused for future phishing campaigns.

Defenders should continue to block the domain at perimeter filters, monitor for any reactivation of the host or related subdomains, and consider adding the IPv6 address to threat intelligence feeds. Ongoing observation of Netlify‑hosted assets originating from the same ASN is advised, as attackers frequently recycle cloud resources to evade detection.