capital-union[.]com

Analysis of capital-union.com indicates it is part of a brand‑impersonation campaign targeting the Capital‑Union Bank brand. The site’s HTML title reads “Capital-Union Bank - Dedicated to innovating, simplifying, and humanizing digital banking.” The domain was registered on 21 February 2026 and is currently taken offline. Network resolution points to IP 107.173.193.235, which belongs to AS36352 HostPapa in the United States. The SSL certificate presented is identified as “R11,” and the Gridinsoft trust score for the domain is 0 out of 100, indicating a lack of trust.

Multiple detection services have flagged the domain: three of ninety‑three VirusTotal scanners returned a positive verdict, and the domain appears on one security blocklist. It is also listed in an AlienVault OTX pulse and is actively blocked by PhishDestroy. The campaign is classified as a crypto‑scam, and the brand target is recorded as “across,” suggesting the impersonation may be aimed at multiple financial brands or a generic bank audience. The concrete evidence points to a malicious infrastructure that leverages a legitimate‑looking brand name to lure victims into cryptocurrency‑related fraud.

Uncertainty remains regarding the exact payload or phishing pages hosted, as no screenshots or login forms have been captured. Defenders should block the resolved IP address and the domain at DNS and proxy layers, update intrusion‑detection signatures to include the observed SSL fingerprint and Gridinsoft score, and monitor for any future re‑registration attempts. Continuous threat‑intel feeds should be consulted for additional indicators, and any inbound traffic to the domain should be logged and investigated for potential crypto‑scam activity.