Capital One lookalike domains
Greyphish has recorded 144 domains that resemble Capital One since February 2026, 7 of them in the last 90 days. Most of them (80%) are typosquats, a keystroke or two away from the real name. .com carries 94% of them, out of 9 endings in all. The busiest week began 13 July 2026, with 10 new ones. 26 certificates for unregistered .com.ph, .ph, .net.ph names (registry wildcard) are excluded: the registry answers for any name under those endings, so nobody had to register one to get a certificate for it.
Data as of . Public sources only.
What kind of lookalikes
Lookalikes per week
Show as a table
| Week of | Typo | Combo | Homoglyph | Total |
|---|---|---|---|---|
| 2026-04-20 | 1 | 0 | 0 | 1 |
| 2026-04-27 | 0 | 0 | 1 | 1 |
| 2026-05-04 | 4 | 2 | 0 | 6 |
| 2026-05-11 | 2 | 0 | 0 | 2 |
| 2026-05-18 | 1 | 0 | 0 | 1 |
| 2026-05-25 | 4 | 1 | 0 | 5 |
| 2026-06-01 | 0 | 0 | 0 | 0 |
| 2026-06-08 | 0 | 1 | 0 | 1 |
| 2026-06-15 | 1 | 1 | 0 | 2 |
| 2026-06-22 | 1 | 0 | 1 | 2 |
| 2026-06-29 | 0 | 0 | 0 | 0 |
| 2026-07-06 | 0 | 0 | 0 | 0 |
| 2026-07-13 | 9 | 1 | 0 | 10 |
| 2026-07-20 | 1 | 0 | 0 | 1 |
| 2026-07-27 | 0 | 0 | 1 | 1 |
| 2026-08-03 | 0 | 0 | 0 | 0 |
| 2026-08-10 | 1 | 0 | 1 | 2 |
| 2026-08-17 | 0 | 0 | 0 | 0 |
| 2026-08-24 | 0 | 0 | 0 | 0 |
| 2026-08-31 | 0 | 0 | 0 | 0 |
| 2026-09-07 | 0 | 0 | 0 | 0 |
| 2026-09-14 | 2 | 0 | 0 | 2 |
| 2026-09-21 | 0 | 0 | 0 | 0 |
| 2026-09-28 | 0 | 0 | 0 | 0 |
| 2026-10-05 | 0 | 1 | 0 | 1 |
| 2026-10-12 | 0 | 0 | 0 | 0 |
Endings
The 8 most used of the 9 top-level domains these lookalikes sit under.
| Ending | Lookalikes | Share |
|---|---|---|
| .com | 135 | 93.8% |
| .net | 2 | 1.4% |
| .biz | 1 | 0.7% |
| .cc | 1 | 0.7% |
| .co.uk | 1 | 0.7% |
| .creditcard | 1 | 0.7% |
| .help | 1 | 0.7% |
| .live | 1 | 0.7% |
Where they are registered
For the 124 with a registrar in WHOIS (86% of all). Brand-protection registrars mostly hold defensive registrations made by brands themselves, so a domain there is more likely the brand's own than an imitation.
| Registrar | Lookalikes | Share | Type |
|---|---|---|---|
| Above.com | 25 | 20.2% | Retail |
| GoDaddy | 17 | 13.7% | Retail |
| Media Elite Holdings | 16 | 12.9% | Retail |
| Dynadot | 10 | 8.1% | Retail |
| Cloudflare | 6 | 4.8% | Retail |
| Unstoppable Domains | 6 | 4.8% | Retail |
| NameSilo | 5 | 4.0% | Retail |
| Spaceship | 5 | 4.0% | Retail |
What the live ones do
Google Web Risk lists none of the 1 live ones checked against it.
1 were tracked while live and 0 have since gone down. See what to do about a lookalike.
Recent examples
The 10 most recent, written with [.] so they cannot be clicked. The brand's own domains and registrations held by brand-protection registrars are left out. A lookalike resembles Capital One; it is not necessarily malicious, and none of these is a claim about who registered it or why.
myaccountcapitalone[.]comCombo, Oct 10MX recordscapitalonex[.]comTypo, Sep 19Not checkedcaspitalone[.]comTypo, Sep 16Not checkedcapitai0ne[.]comHomoglyph, Aug 14Not checkedcappitalone[.]comTypo, Aug 13Not checkedcap1tal0ne[.]comHomoglyph, Aug 1Not checkedsapitalone[.]comTypo, Jul 23Not checkedcpaitalone[.]comTypo, Jul 16Not checkeddapitalone[.]comTypo, Jul 16Not checkedcapitaone[.]comTypo, Jul 13Not checked
Or watch it free: Greyphish tells you when a new lookalike of your domain is registered or goes live.
Further reading
More in banking and payments
Greyphish is not affiliated with Capital One. Domains listed resemble Capital One by spelling; registration alone says nothing about intent. Counts cover domains first seen in public Certificate Transparency logs and ICANN zone files; domains that Greyphish customers watch are excluded.