capitalone-11r[.]pages[.]dev

The domain capitalone-11r.pages.dev is a phishing site engaged in brand impersonation, specifically targeting Ethereum users through a seed-phrase phishing scam. Despite its name suggesting an association with Capital One, the site impersonates Ethereum to deceive victims into revealing sensitive wallet credentials. No crypto drainer kit was identified. The domain is currently taken offline, but it previously posed an elevated risk to users who may have interacted with it.

Technical analysis reveals that capitalone-11r.pages.dev was flagged by 15 of 95 security vendors on VirusTotal, including ADMINUSLabs, Criminal IP, and alphaMountain.ai. It appeared on two security blocklists, PhishDestroy and PhishingDB, but was not flagged by Google Safe Browsing. The domain was registered through Cloudflare, Inc. on March 10, 2026, and resolved to the IP address 172.66.44.144, hosted by Cloudflare in the US. The SSL certificate was issued by Google Trust Services / WE1, and the observed page title was 'Capital One'. Technologies detected include HSTS, Cloudflare, and HTTP/3, with the site currently returning a 403 HTTP status.

Users who may have interacted with capitalone-11r.pages.dev should immediately revoke any token approvals associated with the wallet credentials shared and transfer remaining funds to a new, secure wallet. Enable two-factor authentication (2FA) on all accounts and monitor for unauthorized transactions or login attempts. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts.