loginaccountitrustcapitl[.]webflow[.]io

The domain loginaccountitrustcapitl.webflow.io was observed hosting a credential phishing page that mimics iTrustCapital’s login portal, as indicated by the page title “iTrustCapital Login | The #1 Crypto IRA Retirement Platform.” The site is served through Cloudflare, using HTTP/3, and resolves to IP address 104.18.36.248, which belongs to AS13335 Cloudflare, Inc. in the United States. Registration data shows the domain was created on May 08, 2013 and is registered through MarkMonitor, Inc., a registrar commonly associated with legitimate brand protection services. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming the use of a valid, publicly trusted certificate chain. Technical probing returned an HTTP 404 status, suggesting that the phishing page may have been removed or is otherwise inaccessible at the time of testing.

VirusTotal scans recorded 11 detections out of 95 security vendors, reinforcing the malicious nature of the domain. The site is currently listed on a single security blocklist and has been taken down by the PhishDestroy takedown service. Nameserver records point to journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming Cloudflare’s DNS infrastructure. While the domain’s age and reputable registrar could reduce suspicion in isolation, the combination of targeted page title, detection count, blocklist presence, and takedown action provides strong evidence of credential phishing activity.

Defenders should continue to block the domain at network perimeters, update URL filtering policies, and monitor for any resurgence of the domain or related subdomains. Additionally, security teams should alert users of iTrustCapital to verify any unexpected login prompts and enforce multi‑factor authentication where possible. Ongoing surveillance of Cloudflare‑hosted IP ranges for similar phishing constructs is recommended to pre‑empt future campaigns.