itrustscapiteallogin[.]webflow[.]io

This domain, itrustscapiteallogin.webflow.io, is identified as a credential phishing site targeting users of the iTrustCapital platform, a cryptocurrency individual retirement account (IRA) service. Analysis indicates the domain impersonates the legitimate iTrustCapital login portal, likely designed to harvest login credentials, personal information, and potentially facilitate unauthorized access to retirement funds. No direct evidence of a drainer kit was observed, but the infrastructure aligns with common phishing tactics used in financial and crypto-related fraud. Infrastructure analysis reveals multiple technical indicators of compromise. The domain is flagged by 18 out of 95 security vendors on VirusTotal, and appears on at least one security blocklist. It resolves to the IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335). Registered through NameCheap, Inc., the domain was created on February 21, 2026, an anomalous future date suggesting potential manipulation or falsification of registration records. The SSL certificate is issued by Google Trust Services (WE1), a common feature in phishing sites to mimic legitimacy. Google Safe Browsing (GSB) does not currently list the domain, but the combination of blocklist presence and vendor detections elevates the risk profile. The domain is currently offline, reducing immediate threat exposure. However, the infrastructure remains registered and could be reactivated or repurposed. Response actions should include continued monitoring for re-emergence, reporting to relevant security teams for takedown enforcement, and alerting financial institutions to potential credential exposure. Users who may have interacted with the domain are advised to reset passwords, enable multi-factor authentication, and review account activity for unauthorized transactions. The elevated risk level persists due to the domain’s association with credential theft targeting high-value financial accounts.