reCAPTCHA

To make it harder to analysts to get a good capture of a phishing site, some are using Google's reCAPTCHA service.

References

IOK Rule (edit) 

title: reCAPTCHA
description: To make it harder to analysts to get a good capture of a phishing site, some are using Google's reCAPTCHA service.
references:
  - https://developers.google.com/recaptcha/docs/display

detection:
  buttonElement:
    html|contains|all:
      - "g-recaptcha"
      - "data-sitekey"

  programmaticInvoke:
    js|contains:
      - "grecaptcha.execute("
      - "grecaptcha.render("

  condition: buttonElement or programmaticInvoke

tags:
  - anti-analysis