Security Scan Report: recaptcha.cloud

Submitted: Completed: publiccompleted
This website contacted 9 IPs in 3 countries across 5 domains to perform 12 HTTP transactions. The main domain is recaptcha.cloud and was registered 6 years ago.

Submitted URL: https://recaptcha.cloud/?template=cpg&server=198.251.83.59&ip=178.63.16.224&http=&host=globalcourierxpress.xyz&real_ip=&proto=&url=/track.php?q=78973

The Cisco Umbrella rank of the primary domain is #672,539 of the top 1 million websites

AI Security Verdict

Moderate Risk

Confidence: 76%

5
Risk Score

CAPTCHA-skinned redirect gate on recaptcha.cloud that impersonates reCAPTCHA and auto-forwards visitors to an unrelated host via URL parameters. No forms or malware found, but the deceptive verification and forced redirect make it unsafe.

Risk Factors (4)
Domain name impersonates the reCAPTCHA human-verification brand without owning it
Fake CAPTCHA interstitial acting as an open redirect to an unrelated third-party host
Redirect target injected via URL parameters (server/host/url) — classic abuse-gate / cloaking construction
Misleading security claim ('protected by cPGuard') used to manufacture trust
Safety Factors (5)
No credential, login or payment forms present (0 of each)
No JavaScript malware patterns, no known kit roster match, no threat-intelligence indicators of compromise
Established 6-year-old domain registration; Turnstile/Cloudflare and Google Fonts scripts are ordinary third-party services
Cross-origin script calls go to challenges.cloudflare.com, a legitimate verification provider
Established domain (2508 days old) with no strong malicious indicators — risk clamped from 7 to 5
Domain age information unavailable

Details

Page Title

Human verification

Scan Type

public

Domain Name Analysis

The domain name 'recaptcha.cloud' uses the .cloud top-level domain and has no subdomain. Its registrable label 'recaptcha' stretches across 9 characters with three vowels and six consonants. It segments into two words: re, captcha. Average segment length settles at 4.5 characters. No strong language cues emerged from the frequency lists.

Screenshot

Security scan screenshot of https://recaptcha.cloud/?template=cpg&server=198.251.83.59&ip=178.63.16.224&http=&host=globalcourierxpress.xyz&real_ip=&proto=&url=/track.php?q=78973

Page Load Overview

0.36s
Total Load Time
946 KB
Total Size

Language Analysis

Primary Language

🇺🇸English
Code: en
Confidence:54%
Script:Latin
Direction:ltr

Detection Details

Text Length:468 chars
Detector Agreement:100%

Website Classification

Primary Category

unknown0% confidence
Type: static
Method: structural

All Detected Categories

No categories detected

Detected Features

No structural features detected

Domain & IP Information

RequestsIP AddressLocationAS Autonomous System
478.47.205.166Nuremberg, Bavaria, Germany
AS24940Hetzner Online GmbH
195.217.5.229Helsinki, Uusimaa, Finland
AS24940Hetzner Online GmbH
1142.251.13.95Google · CDNUnited States
AS15169Google LLC
1104.18.95.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
1142.251.14.95Google · CDNUnited States
AS15169Google LLC
1142.250.154.94Google · CDNUnited States
AS15169Google LLC
1157.90.254.77Falkenstein, Saxony, Germany
AS24940Hetzner Online GmbH
1192.178.183.94Google · CDNUnited States
AS15169Google LLC
1104.18.94.41Cloudflare · WAFUnited States
AS13335Cloudflare, Inc.
129--

Detected Technologies7

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

Security-focused

Specialized for malware detection and similarity analysis

T17B839EA857B30190AA13926C57EA1F093B70D00B5C1ACD5CB7DE9748CF87EE8A991F5C

ssdeep (Context Triggered Piecewise Hashing)

Context-aware

Detects similar content even with modifications

1536:9jw2Pd7ElawXGls+rlEh+J5Go8bezM5jvyY:9jw2FIcuyG+tcoMr

sdhash (Similarity Digest Hashing)

High-precision

High-precision similarity detection for forensic analysis

sdhash:3:82776:0BQCQlKQIfogQYQXil3vAZY6T2ASxRHA2lAQGjQVVhBUAwWCIoEAExx0NWxAMOMcsCoALgADhCkpJLakqADgVYJAJ5SyxBI4

These hashes enable detection of similar websites and malware variants by comparing content similarity even when exact matches aren't found.

Image Hashes

Perceptual Hashes

Average Hash:ffc7c7e7c7cfffff
Perceptual Hash:b026cd99cece3931
Difference Hash:000c1c0c0c140010
Wavelet Hash:3c04000427033f3f
Color Hash:#783a3f

Other Hashes

Crop Resistant:000c1c0c0c140010

Scan History

Scan history not available

Unable to load historical scan data