Capital One

Banking United Statescapitalone.comRank 529 of the most impersonated
Cert findings · 24 h
2
Cert findings · 7 days
3
1 reported or listed · 2 on phishing hosts
Registered lookalikes
99
8 listed by a source or an address list
Official domains
11
verified from Capital One's own sites and records

Certificate findings for Capital One

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Capital One's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 3 findings, grouped by hostname

  1. capitalone.cm US · AS46475 · Limestone Networks, Inc.2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 17 y ago
    DetailsHide
    Hostname
    capitalone.cm
    First seen
    2026-11-05 09:00 UTC
    First published
    2026-10-28 06:38 UTC
    DNS
    Resolves · checked 2026-11-05 09:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.54.
    1. Phishing-host list fetched with the address
    2. Resolved to 69.162.80.54
    Brand
    Capital One
    Addresses
    69.162.80.54 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    69.162.80.60 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    capitalone.cm
    Registered
    2009-08-28 · Netcom.cm Sarl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  2. portalteam.net JP · AS9370 · SAKURA Internet Inc.
    ListedListed by JPCERT/CC as imitating Capital OneMX presentSPF ~allDMARC policy noneRegistered 5 y ago
    DetailsHide
    Hostname
    portalteam.net
    First seen
    2026-11-05 04:31 UTC
    First published
    2026-11-05 05:17 UTC
    Listing
    JPCERT/CC confirmed it 2026-06-15 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 02:09 UTC
    DNS
    Resolves · checked 2026-11-05 05:23 UTC
    Listed
    JPCERT/CC
    1. Confirmed by JPCERT/CC
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 03:30 UTC to 2027-02-03 03:30 UTC
    Logged 2026-11-05 04:28 UTC in Google ParcelYard2027h1, entry 619,777,163
    SHA-256 41b7959c7555448cff342c1016779ce584fd5fbb1ebb0fa0b5d1b467b79bd9c9
    Public key SHA-256 a85cfecc60a92123ad3f51af4467b5dbe4d6041a7b9d75e4a29453058b0af23e
    Brand
    Capital One
    Addresses
    59.106.191.205 · Japan · AS9370 SAKURA-B - SAKURA Internet Inc.
    Domain
    portalteam.net
    Registered
    2021-11-29 · GMO Internet Group, Inc. d/b/a Onamae.com
    MX
    Receives mail at portalteam.net
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 05:17 UTC

    Suggest a correction

  3. u-capitalone.com PT · AS39384 · IT Services, Lda
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 4 y ago
    DetailsHide
    Hostname
    u-capitalone.com
    First seen
    2026-11-01 09:01 UTC
    First published
    2026-11-01 09:09 UTC
    DNS
    Resolves · checked 2026-11-05 09:21 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.240.248.34.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.240.248.34
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-11-01 08:01 UTC to 2027-01-30 08:01 UTC
    Logged 2026-11-01 08:59 UTC in Let's Encrypt Sycamore2027h1, entry 884,940,401
    SHA-256 04ede864bf91023fd3ae2194d0c1a88e0c261ff602cb603e85a14df6acac8f2a
    Public key SHA-256 79f2cf48f7b3732d97ed30e49e0a7af853148a99cbb774c22bd5018d1058864c
    Brand
    Capital One
    Addresses
    185.240.248.34 · Portugal · AS39384 RACKFIBER Dream Fusion - IT Services, Lda
    Domain
    u-capitalone.com
    Registered
    2022-12-13 · PDR Ltd. d/b/a PublicDomainRegistry.com
    MX
    Receives mail at u-capitalone.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Capital One when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Banking

All brands →