🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

URLhaus Database

You are currently viewing the URLhaus database entry for https://api.recapcha.fun/auth/v1?token=304 which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3951661
URL: https://api.recapcha.fun/auth/v1?token=304
URL Status:Offline
Host: api.recapcha.fun
Date added:2026-10-18 06:14:40 UTC
Last online:2026-10-20 04:XX:XX UTC
Threat:Malware download Malware download
URLhaus blocklist:Not blocked
Spamhaus DBL :Abused domain (malware)
SURBL :Not blocked
Quad9 :Status unknown
AdGuard :Not blocked
Cloudflare :Not blocked
dns0.eu :Status unknown
ProtonDNS :Status unknown
OpenBLD :Not blocked
DNS4EU :Not blocked
Reporter: shmulc
Abuse complaint sent (?): Yes (2026-10-19 16:05:59 UTC to abuse{at}amazonaws[dot]com)
Takedown time:1 day, 21 hours, 44 minutes Poor (down since 2026-10-20 04:00:18 UTC)
Tags:ClickFix ContagiousInterview DPRK fake-recruitment

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-10-19v1bat 167c5bcf5b00ca1827684935a2e033045b50de99cbb00b4829f75e2a3db6db47n/a 
2026-10-19v1bat 18dd54b3c61fbe468fa416d7260bc1bc248f345ed94ef0fa8e38999b05c7fe1dn/a 
2026-10-19v1bat f044421a4324064cc98b8cab927b5ac99b2a30e6908a949b520baaffa567b376n/a 
2026-10-18v1bat bfddddbd155a53032036d0504166e5093944669fcbff944cc6ed919aa3e32194n/a 
2026-10-18v1bat 4c278e4a532d1e4e4f17de78411360228f8f67ed9da5356bc38962bd3d69830bn/a