i-sso-itrustcapital-com-i[.]webflow[.]io

The domain i-sso-itrustcapital-com-i.webflow.io was registered on February 21, 2026 through NameCheap, Inc. and is presently taken offline. DNS resolution points to Cloudflare nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the domain resolves to IP address 104.18.36.248, which is part of AS13335 Cloudflare, Inc. and geolocated to the United States. The site presented a page titled "Log in" and returned an HTTP 404 status, indicating the malicious landing page was removed or never fully hosted.

SSL/TLS termination is provided by Google Trust Services under the WE1 certificate, confirming the use of a legitimate certificate authority but offering no protection against credential harvesting. Cloudflare and HTTP/3 were detected as the underlying technologies, consistent with the hosting infrastructure. VirusTotal scans flagged the domain in 14 of 93 security vendor engines, and the site is listed on a single external security blocklist.

PhishDestroy has already blocked the domain, reinforcing its classification as a credential phishing attempt that impersonates iTrustCapital. While the domain’s offline status limits immediate threat exposure, defenders should continue to monitor for reactivation, enforce domain‑based blocking for the exact host, and educate users about unsolicited login prompts referencing iTrustCapital. Further analysis is needed to determine whether additional infrastructure (e.g., command‑and‑control servers or phishing kits) is associated with this domain, as current intelligence is limited to hosting and detection attributes.