capital1credit-union[.]com

This domain is flagged as a high-risk generic phishing threat impersonating Capital One Credit Union. Analysis indicates that it was registered on October 30, 2025, through Global Domain Group LLC, and resolves to IP address 198.251.84.200, which is hosted in Luxembourg by FranTech Solutions. The domain is still active as of the report date, July 12, 2026, and serves a page titled 'Capital One Credit Union Bank' using a Let's Encrypt SSL certificate (R13). The HTTP status code is 302, suggesting a redirect mechanism that may lead visitors to a credential harvesting page.

VirusTotal data shows that 6 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. The PhishDestroy service also blocks this domain. The Gridinsoft trust score is 0 out of 100, indicating a complete lack of trustworthiness. The domain creation date, approximately eight months before detection, suggests the infrastructure may have been prepared in advance for a prolonged campaign.

What remains uncertain is the specific phishing kit in use, the full redirect chain, and the complete list of targeted credentials. It is not yet known whether this domain is part of a larger cluster of lookalike domains or if it employs dynamic content delivery to evade detection. The actual landing page content and any obfuscation techniques have not been fully assessed.

Defenders should immediately block this domain at the network and email gateway levels to prevent access by users. Organizations should search for any email or web traffic attempting to reach capital1credit-union.com and investigate any credentials that may have been entered on the page. The IP address 198.251.84.200 should be monitored for associated malicious infrastructure. Employees should be alerted to the impersonation attempt and reminded to verify official bank URLs.