itrstcptllogin[.]webflow[.]io

PhishDestroy identifies itrstcptllogin.webflow.io as an active credential phishing domain impersonating a legitimate service to harvest user credentials.

This domain was flagged by 15 of 95 VirusTotal vendors and resolves to IP 172.64.151.8, hosted on Google Trust Services infrastructure. The domain, registered under Webflow, was created recently and has accrued multiple blocklist detections, though no specific registrar or creation date was provided in the available intelligence.

Given the elevated risk level and active status, users are advised to avoid interacting with this domain entirely. Organizations should block the domain and associated IP at the network perimeter. If credentials were entered, users must rotate passwords immediately and enable multi-factor authentication where applicable. Security teams should monitor for follow-on compromise attempts and update detection rules to include this domain and IP as indicators of compromise.