Speedcaptcha-here.top: what it is and how to remove it
Speedcaptcha-here.top is a deceptive page disguised to look like a CAPTCHA verification step. It was created for the purpose of generating revenue from pay-per-click advertising.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
After a fake CAPTCHA on speedcaptcha-here[.]top, a scan of the PC is a quick first check before you change passwords.
Do it yourself · free Remove Speedcaptcha-here.top yourself 4 steps, about 12 minutes, no software needed.
Start the steps
Speedcaptcha-here.top: summary
| Distribution | Shady websites; deceptive ads; freeware installations |
|---|---|
| NAME | Speedcaptcha-here.top |
| TYPE | Push notification spam; adware |
| SYMPTOMS | Annoying pop-ups start appearing in the corner of the screen even when the browser is closed |
| DANGERS | Links embedded in the pop-up ads can lead to dangerous websites that use social engineering techniques |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Damage | Not recorded in the old report |
|---|---|
| Name | Speedcaptcha-here.top |
| Type | Fake CAPTCHA page |
| Symptoms | A fake CAPTCHA asking to press Win+R |
| Evidence | 5 write-ups by security sites; details still limited |
| Imitates | A human-verification check |
| Domains | speedcaptcha-here[.]top |
| First seen | 19 April 2022 |
| Facts checked | 6 October 2026 |
What the Speedcaptcha-here.top pop-up looks like
Type Allow to verify that you are not a robot
Click Allow to watch the video
Download is ready. Click Allow to download your file
Press Allow to verify that you are not a robot
Is the Speedcaptcha-here.top check real?
- Address:
speedcaptcha-here[.]top
From our report of Apr 2022 · not reviewed since
More from our earlier report on Speedcaptcha-here.top
- Disable push notifications in your browser settings
- Use a maintenance tool like to get fix any remaining damage and optimize the system
What to do if you ran the Speedcaptcha-here.top command
Whether you ran the command decides everything else, so the first step checks that.
Step 1: Check whether the pasted command ran
The fake check asked you to press Windows + R, paste and press Enter. Open the same box and look at its drop-down history: a
powershell,mshtaor curl line you did not type yourself is the command Speedcaptcha-here.top gave.Once run, it fetches malware within seconds, so take the PC offline and follow all the remaining steps. If the history is empty or harmless, nothing was started on the Windows 11 or Windows 10 PC.
Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 2: Scan the PC, then run the offline scan
A scan finds the parts of Speedcaptcha-here.top that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 3: Change passwords from another device and sign out other sessions
Speedcaptcha-here.top can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Step 4: Delete scheduled tasks that bring it back
Programs like Speedcaptcha-here.top add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Stream videos without limitations, no matter where you are
There are multiple parties that could find out almost anything about you by checking your online activity.
While this is highly unlikely, advertisers and tech companies are constantly tracking you online. The first step to privacy should be a secure browser that focuses on tracker reduction to a minimum.
Even if you employ a secure browser, you will not be able to access websites that are restricted due to local government laws or other reasons. In other words, you may not be able to stream Disney+ or US-based Netflix in some countries. To bypass these restrictions, you can employ a powerful VPN, which provides dedicated servers for torrenting and streaming, not slowing you down in the process.
Data backups are important - recover your lost files
Ransomware is one of the biggest threats to personal data.
Once it is executed on a machine, it launches a sophisticated encryption algorithm that locks all your files, although it does not destroy them. The most common misconception is that anti-malware software can return files to their previous states. This is not true, however, and data remains locked after the malicious payload is deleted.
While regular data backups are the only secure method to recover your files after a ransomware attack, tools such as can also be effective and restore at least some of your lost data.
From our report of Apr 2022 · not reviewed since
Speedcaptcha-here.top is made to look like a human verification step so users would click "Allow"
Speedcaptcha-here.top is a deceptive page disguised to look like a CAPTCHA verification step.
It was created for the purpose of generating revenue from pay-per-click advertising. The site uses social engineering methods to trick people into allowing push notifications.
Crooks may use rogue advertising networks that place ads leading to dangerous websites. As a result, people can be convinced to provide their personal information, download PUPs (potentially unwanted programs), and even malware. This can cause monetary losses, identity theft, and operating system damage.
From our report of Apr 2022 · not reviewed since
What is CAPTCHA?
It is clear that the creators of Speedcaptcha-here.top tried to make it look like a CAPTCHA verification step.
Usually, websites use it to make sure that it is visited by real people and not bots. However, a legitimate process normally looks completely different.
Most of the time, users are asked to identify certain objects in pictures, like crosswalks, bicycles, or pedestrians. The simplest form of the human verification process is asking a person to just check a box. Speedcaptcha-here.top and other push notification spam pages ask users to choose between "Block" and "Allow" on a browser prompt that says "(the website name) wants to show you push notifications."
If you do not want to get spammed with commercial content, you should never subscribe to push notifications as pages rarely use them to provide valuable information. There are many variations of these spam pages and they all display fake messages and images to fool users. Some of the messages you may see include:
From our report of Apr 2022 · not reviewed since
Distribution methods
People rarely stumble upon such websites from search results.
Generally, they hide in other shady pages that are full of deceptive ads and sneaky redirects. People should be careful of sites that are unregulated because they are breeding grounds for all kinds of malware. This usually includes pages that engage in illegal activities.
Even though Google said it would get rid of fake "Download" and "Play" buttons, they still exist. Try to use only official web stores and developer websites whenever you want to install software to avoid being tricked by dubious buttons. They can redirect users to harmful sites or make them download PUPs and malware instead of the intended software.
Users should also not dismiss the possibility that Speedcaptcha-here.top appeared without any user input. This can be caused by an adware infection. It is advertising-supported software that can automatically generate commercial content in the machine, like pop-ups, banners, and redirects.
From our report of Apr 2022 · not reviewed since
Disable push notifications
If you want to get rid of these pesky pop-ups, you should access the settings of your web browser and perform the following steps:
Google Chrome (desktop):
Google Chrome (Android):
MS Edge (Chromium):
- Open Google Chrome browser and go to Menu > Settings.
- Locate the Privacy and security section and pick Site Settings > Notifications.
- Look at the Allow section and look for a suspicious URL.
- Click the three vertical dots next to it and pick Block. This should remove unwanted notifications from Google Chrome.
- Open Google Chrome and tap on Settings (three vertical dots).
- Select Notifications.
- Locate the unwanted URL and toggle the button to the left (Off setting).
- Open Mozilla Firefox and go to Menu > Options.
- Click on Privacy & Security section.
- Under Permissions, you should be able to see Notifications. Click Settings button next to it.
- In the Settings – Notification Permissions window, click on the drop-down menu by the URL in question.
- Select Block and then click on Save Changes. This should remove unwanted notifications from Mozilla Firefox.
- Click on Safari > Preferences...
- Go to Websites tab and, under General, select Notifications.
- Select the web address in question, click the drop-down menu and select Deny.
- Open Microsoft Edge, and click the Settings and more button (three horizontal dots) at the top-right of the window.
- Select Settings and then go to Advanced.
- Under Website permissions, pick Manage permissions and select the URL in question.
- Toggle the switch to the left to turn notifications off on Microsoft Edge.
- Open Microsoft Edge, and go to Settings.
- Select Site permissions.
- Go to Notifications on the right.
- Under Allow, you will find the unwanted entry.
- Click on More actions and select Block.
From our report of Apr 2022 · not reviewed since
Clear your browsers
Most websites you visit have the ability to track your browsing activities, like the links you click on, things you purchase online, as well as your IP address, and geolocation.
This can happen thanks to small data files that are called cookies. Unfortunately, they can be sold to advertising networks and other third parties which raises many user privacy and security concerns.
Security experts recommend clearing browsers from cookies and cache regularly to prevent them from ending up in shady individuals' hands. It can automatically delete accumulated cookies, fix various system errors, corrupted files, and registry issues, which is especially helpful after a virus infection.
From our report of Apr 2022 · not reviewed since
PUPs
Potentially unwanted applications can be distributed by the method known as software bundling, or they can appear as useful tools that provide many benefits, and the users download them voluntarily.
Usually, they do not work as advertised and are not actually functional. Instead, they perform tasks in the background, like tracking users' browsing behavior, spamming them with pop-ups, and causing browsers to redirect to shady pages constantly. It is not recommended to keep these apps installed on your machine as they can cause more harm than good.
To avoid the installation of adware you should stay away from freeware distribution platforms. They include additional programs in the installers to make a profit. Always choose the "Custom" or "Advanced" installation methods, read the Privacy Policy, and Terms of Use. The most important part is to check the file list and untick the boxes next to any unrelated apps.
The best course of action to completely get rid of pop-ups from Speedcaptcha-here.top would be to use professional security tools like , or . They can help you detect viruses, and suspicious processes running in the background and see if you have adware hiding in your system.
To fully remove an unwanted app, you need to access Application Support, LaunchAgents, and LaunchDaemons folders and delete relevant files:
- Enter Control Panel into Windows search box and hit Enter or click on the search result.
- Under Programs, select Uninstall a program.
- From the list, find the entry of the suspicious program.
- Right-click on the application and select Uninstall.
- If User Account Control shows up, click Yes.
- Wait till the uninstallation process is complete and click OK.
- From the menu bar, select Go > Applications.
- In the Applications folder, look for all related entries.
- Click on the app and drag it to Trash (or right-click and pick Move to Trash)
- Select Go > Go to Folder.
- Enter /Library/Application Support and click Go or press Enter.
- In the Application Support folder, look for any dubious entries and then delete them.
- Now enter /Library/LaunchAgents and /Library/LaunchDaemons folders the same way and terminate all the related .plist files.
Questions about Speedcaptcha-here.top
I pressed Win+R and pasted the code from speedcaptcha-here[.]top. Am I hacked?
Assume yes and act now. The command a fake CAPTCHA on speedcaptcha-here[.]top copies to your clipboard downloads and runs malware, usually an information stealer or a remote access trojan, and stealers can copy browser passwords and cookies within a minute. Disconnect the PC from the internet.
Run a Microsoft Defender Offline scan, then remove new startup items, scheduled tasks and programs. From another device, change your e-mail password first, then banking and everything else saved in the browser, sign out of all sessions and turn on two-step verification. If crypto wallets were on the PC, move the funds from a clean device.
Could Windows Security have stopped the speedcaptcha-here[.]top command?
Sometimes. Microsoft Defender blocks many known ClickFix scripts and payloads, and Protection history in Windows Security will show it if it did. But campaigns change quickly, and a command you ran yourself starts with your permissions, so a new variant can get through before signatures catch up.
Check Protection history for entries from the time you visited speedcaptcha-here[.]top. Whatever it shows, run an offline scan, look for new startup items and change your important passwords from another device, because stealers act fast and what they took cannot be called back by a later detection.
Does a human-verification check know about Speedcaptcha-here.top?
Large brands such as a human-verification check are aware that scammers copy their names and logos, and most have pages where you can report such abuse. They do not run these pages and do not profit from the warnings themselves.
Sometimes an affiliate of an antivirus vendor sends traffic through fake alerts, which breaks the vendor's rules and gets the affiliate banned when reported. If you want to help, report the page address to the brand's security team and to your browser through its report option.
Why does my browser keep opening speedcaptcha-here[.]top?
Because something sends you there. The usual causes are a notification permission you gave to some site, an adware extension, or a site you visit often that shows redirect ads. The site itself cannot open on its own.
Remove unknown sites from the notification settings, check the extensions list, and do not restore the previous session when the browser starts. If the page appears even with the browser closed, look in Installed apps for programs you did not install. Running a scan with Windows Security afterwards confirms that nothing else is involved.
Why does Speedcaptcha-here.top use the a human-verification check design?
Because people see real a human-verification check checks every day and click through them without thinking. The attackers copy the familiar box, the colours and the wording, then add a few extra steps that look like part of the routine.
The trust in the real service is what makes the trick work. That is also why the page appears on ordinary websites: a hacked site with a familiar check feels safe. The extra keyboard steps are the only reliable sign, and they are always fake.
Do I need to reset my router because of Speedcaptcha-here.top?
No. Fake alert pages work inside the browser and do not change router settings. The sign reported is A fake CAPTCHA on speedcaptcha-here[.]top that asks you to paste a command, which comes from a web page, not from the network. Resetting the router will not stop it.
What stops it is removing the browser permission, extension or program that opens the page. If you see the same page on every device in the house without visiting the same sites, that is unusual and worth checking the router's DNS settings, but it is not what has been reported here.
I closed it, but it appeared again the next day. Why?
A page that returns on its own has a trigger. Look at how it appeared: from a pop-up in the corner of the screen means a notification permission; on start-up means a session restore or a changed start page; while browsing any site means an extension; on one particular site means that site's ads.
Each has a quick fix in the browser settings. If none of them explains it, reset the browser, which clears permissions, extensions and start pages together.
How did Speedcaptcha-here.top find me?
It did not target you personally. Pages like this buy traffic from shady ad networks and from hacked sites, and they show A fake CAPTCHA on speedcaptcha-here[.]top that asks you to paste a command to whoever is redirected to them.
Mistyped addresses, streaming and download sites, and earlier clicks on Allow for notifications are the most common entry points. Nothing about your PC was scanned or known in advance. Once you remove the trigger in the browser, the page has no way to reach you again unless you meet a similar ad.
Why is pasting a command so dangerous?
Because it skips every protection that would stop a normal download. Browsers check files you download and SmartScreen checks programs you open, but a command you type yourself is trusted as your own action. Pages like Speedcaptcha-here.top exploit exactly this.
The command fetches and runs code in memory, often leaving little on the disk for a quick scan to find. That is why the advice is absolute: no website has a legitimate reason to make you paste anything into Run, Terminal or PowerShell.
Will Fortect remove Speedcaptcha-here.top?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Speedcaptcha-here.top, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- HowToGeek: PUPs Explained: What is a "Potentially Unwanted Program"? (read October 6, 2026)
- Malwarebytes: Adware (read October 6, 2026)
- Kaspersky: What are Cookies? (read October 6, 2026)
- Wikipedia: Freeware (read October 6, 2026)
- FTC: How to spot, avoid and report tech support scams (read October 6, 2026)