Use of CAPTCHA and Trusted Hosting to Evade Automated Analysis

Threat actors may place campaign material on established Internet services and/or put an interactive CAPTCHA before later page content. A CAPTCHA gate can filter automated URL analysis, while trusted-service hosting can make traffic resemble expected use; neither guarantees that a sandbox or human analyst will fail to inspect the activity. These are distinct behaviors that may occur independently.