Netskope outlines FakeCaptcha PDF traffic-distribution routing

Security researchers report a campaign that uses thousands of structurally similar FakeCaptcha PDF files hosted on Webflow’s CDN to feed a traffic-distribution system that routes visitors to malware, ad landers, or premium-SMS scams.

Research Overview

Netskope observed more than 12,700 FakeCaptcha documents with the same underlying PDF structure, with copies tied to search terms and indexed as benign “upgrade guides.” The documents route clicks into an Elixir/Phoenix-based traffic distribution system that applies multiple gate checks before sending traffic to different downstream buyers.

The write-up focuses on the distribution layer, including how the gate decides which visitors qualify for resale. It also describes how the same delivery approach is used across multiple infrastructure rotations over more than 14 months.

Key Findings

In Netskope telemetry, the primary acquisition channel was Google search, contributing about 98% of the referrer mix, with smaller shares from Bing, PDF aggregator sites, and direct navigation. The exposure skewed to English-speaking regions, led by the United States, India, Australia, the United Kingdom, and Canada, spanning 26 countries.

In roughly 3% of the environments where downloads were seen, the referrer was an AI assistant, including Google Gemini and Claude, plus one internal enterprise assistant. The reporting notes that referrer data alone does not show whether the assistant cited the PDF or users pasted links the assistant surfaced, but the structural exposure remained the same.

Technical Breakdown

The FakeCaptcha lure uses a “non-robot” panel embedded in each PDF, which triggers entry into a custom TDS. Netskope describes a multi-stage filter sequence: an IP and autonomous-system check during the TLS handshake, followed by a Cloudflare Turnstile challenge and a Joken JSON Web Token flow.

After those checks, the router performs geo and device filtering using a ww80/wwNN traffic router subdomain pattern. The gate distinguishes qualifying from non-qualifying visitors and routes each group along different paths.

Operational Impact

Netskope reports that the TDS splits traffic into multiple downstream branches. Qualifying traffic is routed to malware or scam infrastructure, while non-qualifying visitors are sent to a search-arbitrage ad lander designed to monetize clicks.

The campaign also shows rotated lure infrastructure: Netskope lists 2025 lure domains such as dutabuz[.]com and zuwufag[.]com, then a 2026 pool including nurepikis[.]com, tugoduzak[.]com, maxudijuz[.]com, and pofezaf[.]com. The reporting says several 2025 intermediary domains were drop-caught and reused as front-door lure entries, while the PDF factory and routing architecture remained in place.

Leadership Perspective

Netskope frames the detection challenge as tied to what changes versus what persists across time. It states that the delivery host is a shared CDN used by many Webflow customers, so blocking that host is not treated as an option.

Instead, Netskope points to longer-lived detection points such as the stable PDF structure across clusters and the persistent wwNN router subdomain pattern, while noting that lure domains turn over more quickly. It adds that one gate can serve many unrelated referer domains, so blocking only the lure entries removes access to the funnel rather than disabling the gate.

Netskope’s report describes a FakeCaptcha PDF “factory” feeding a traffic-distribution system that routes visitors to malware distribution, ad landers, or premium-SMS scams, with a consistent gate design across rotating lure domains. This “Blog Signals brief” is a fact-based summary of the vendor blog.

The original article was written by Decision Insights Editorial.