itrustcapitacewlogin[.]webflow[.]io

PhishDestroy has identified the domain itrustcapitacewlogin.webflow.io as a sophisticated brand impersonation threat specifically targeting iTrustCapital, a popular self-directed IRA investing platform. The domain is currently offline, but its recent activity and deceptive design posed significant risks to unsuspecting users. The page title "iTrustCapital Login - Easy Self-Directed #IRA Investing" was crafted to closely mimic the legitimate iTrustCapital login page, aiming to steal credentials and potentially drain cryptocurrency assets.

Technical analysis reveals several concerning indicators. The domain was registered through NameCheap, Inc. on February 21, 2026, and resolves to IP address 104.18.36.248, which is associated with Cloudflare. It uses an SSL certificate issued by Google Trust Services (WE1), giving it a false sense of legitimacy. VirusTotal data shows that 14 out of 95 security vendors flagged this domain as malicious, and it appears on at least one security blocklist. The domain's creation date and rapid takedown suggest it was part of a short-lived but aggressive phishing campaign.

Given that this domain has been taken offline, the immediate risk is mitigated. However, users who may have interacted with the site before its removal should change their iTrustCapital passwords immediately and enable two-factor authentication. PhishDestroy recommends monitoring accounts for unauthorized activity and avoiding similar domains that use variations of the iTrustCapital brand. Always verify URLs directly by typing the official website address into the browser rather than clicking on links from emails or messages.