d26hpdecvhwn5s[.]cloudfront[.]net

Analysis of the domain d26hpdecvhwn5s.cloudfront.net indicates it is actively serving a high-risk phishing page targeting users of a major financial institution. The page title, 'Capital One | Credit Cards, Checking, Savings & Auto Loans,' explicitly matches the branding of Capital One, suggesting an intent to deceive visitors into believing they are accessing legitimate banking services. The domain is hosted on Amazon CloudFront infrastructure, resolving to IP address 13.32.121.92, and employs an SSL certificate issued by Amazon, which may lend a false sense of security to unsuspecting users. The domain appears on three security blocklists and is flagged by 17 of 95 security vendors in a recent scan, confirming its malicious classification. It is registered through MarkMonitor Inc., a legitimate domain registrar often used for both legitimate and malicious purposes. Technologies detected on the domain include Amazon Web Services, Amazon S3, Snowplow Analytics, and HSTS, which are consistent with modern web hosting but do not mitigate the phishing risk. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. As of July 12, 2026, the domain remains active and unmitigated. Defenders should immediately block access to this domain at the network level and monitor for any attempts to interact with it from internal systems. End users who may have visited the site should be advised to change credentials for any accounts accessed after exposure and enable multi-factor authentication where possible. The exact content and functionality of the phishing page have not been fully analysed, so additional indicators of compromise may emerge as further investigation is conducted.