They really don't want to know!
You think they're testing for a human, but they're not.
No, your captcha isn't to prove you're human. Let that sink in. These are cleverly constructed redirect gateway pages disguised as a human-verification page.
After reporting several hundred Google pages sent in spam it occurred to me that something wasn't quite right. Many sites use captchas, and the public has become very comfortable with performing them. But what if they really aren't trying to see you're human? What if their main purpose is recording you, tracking you and sending you to a cyber crime Phishing or Scam page? What if they're fake. So I decided to analyze the code . . . .
Take a look at the code
Note in the code, the cyber crooks have included an invisible notation telling the programmer to insert a new spam address into that spot.
The most significant characteristic of the entire captcha page is that the apparent verification process does not perform actual verification.
It doesn't. There's simply no code that functions to "prove" you're human. It does do a number of things.
This is arguably the most important line in the entire document:
This is the "destination" link. The initial link was at Google.com. This link takes you to a spoofed Cloud Storage scam. The slider is an engagement gate. It requires interaction before exposing the user to the final destination. The destination is configurable. The hardcoded URL contains campaign-style identifiers, which may help the cyber criminals distinguish traffic sources or campaigns -- to stalk you. They finish the deception by showing you an 800-millisecond delay, giving the page time to display a convincing success message before navigating away.
The slider itself does not steal credentials or payment information. Its role is to move the visitor to the next stage. The fraudulent phishing arrival page is where the actual financial deception occurs. It is a phishing delivery mechanism disguised as human verification, with a fraudulent cloud-storage purchase page at the end of the redirect chain.
- The CAPTCHA is a deception layer. It creates the appearance of legitimate security verification without performing any meaningful verification.
- The slider is an engagement gate. It requires interaction before exposing the user to the final destination.
- The navigator.webdriver check is an automation filter. It attempts to discourage certain automated browser inspections.
- The destination is configurable. The hardcoded URL contains campaign-style identifiers, which may help operators distinguish traffic sources or campaigns.
- The delayed redirect is intentional. The 800-millisecond delay gives the page time to display a convincing success message before navigating away.
The most significant characteristic is that the apparent verification process does not perform actual verification. It merely requires a user to move a slider to its endpoint before sending the browser to an externally specified destination. That pattern can be used in legitimate advertising and traffic-routing systems, but it can also be used in deceptive redirects and phishing campaigns.
Why are Google-hosted CAPTCHA links being used as an intermediary in unsolicited (spam) email campaigns that ultimately deliver fraudulent product purchase pages?
That's rather disturbing.
- The cybercrime industry uses Google to provide the captcha redirect,
- The code of the captcha provides CloudFlare with tracking
- The target page captures the victim and attempts to defraud
- Then CloudFlare delays discovery of the actual criminals
Yes, it is truly incredible. Each day, thousands of victims are attacked -- maybe millions. They have no idea what hit them. So far we have been unable to find a programmer with the capability nor the desire to write code to take over this task. AI engines tell us they can't do it ... it still takes a human to see whether or not it's a criminal act.
BOTTOM LINE : DO NOT CLICK
Thank you for reading!
SafeNetting . . . . SafeNetting Content on Medium
NOTE : if you are from LAW ENFORCEMENT and wish to check further, the actual spam, and research dossier is available upon request.
REFERENCE LINKS
- CAN-SPAM Act: A Compliance Guide for Business Advertising and Marketing Online
- CAN-SPAM Act: A Full legal text (U.S. law) The CAN-SPAM Act is codified in 15 U.S. Code Chapter 103 (15 U.S.C. §§ 7701–7713). You can read the statute in full on: govinfo (official U.S. government legal database): CAN-SPAM Act on govinfo
- Cornell Legal Information Institute (clean, readable version):15 U.S. Code Chapter 103 - Controlling The Assault of Non-Solicited Pornography And Marketing
- FTC Act Section 5 that apply to a phishing email, the governing law is: Federal Trade Commission Act — 15 U.S.C. § 45 (Section 5)
- Computer Fraud and Abuse Act (CFAA) Cornell Legal Information Institute (clean readable version) often used in phishing cases because it covers: * credential theft schemes * fake login pages * unauthorized access obtained via deception
- Title 18 of the U.S. Federal Code the full U.S. Government Publishing Office official U.S. code
© 1988–2026 · Safe Netting · SafeNetting.com · All rights reserved.
FAIR USE NOTICE: This web site may make use of copyrighted material. Such material are made available for commentary and educational purposes only. This constitutes a "Fair Use" of any such copyrighted material as provided for in TITLE 17 U.S.C. SECTION 106A-117 of the United States Copyright Law.
Safe Netting, Safenetting.com, all rights reserved, ©2000 through present. Established on the internet in 2000, as part of the User Group Network. Safenetting was launched by brothers Joe Showker and Fred Showker as a community service to help educate the public on the dangers of the internet and connected world ** InfoManager is a trademarks for the User Group Network, ©1994