ssso-itrustcapital-com--cdn[.]webflow[.]io

Analysis of the domain ssso-itrustcapital-com--cdn.webflow.io indicates a credential‑phishing campaign targeting customers of iTrustCapital. The site is hosted on Cloudflare infrastructure (ASN 13335) and resolves to IP 172.64.151.8, which is located in the United States. The domain was registered on 8 May 2013 through MarkMonitor, Inc., and the authoritative name servers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com. TLS termination is provided by Google Trust Services under the WE1 certificate, confirming that HTTPS connections are encrypted but not attesting to the legitimacy of the content.

A scan on VirusTotal returned 14 positive detections out of 95 engines, and the domain is listed on the PhishDestroy blocklist, indicating multiple security vendors have observed malicious behavior. The HTTP response code is 404, and the only visible page title is “Itrust capital login | Best Cryptocurrency Exchange,” which aligns with the claimed credential‑phishing objective. The site leverages Cloudflare’s HTTP/3 support, but no additional technology stacks were identified. While the domain’s age and registrar suggest a long‑standing registration, the recent detection activity and blocklist presence point to an active abuse phase that has since been taken offline.

The exact content served at the time of operation has not been captured, so the specific tactics used to harvest credentials remain unknown. Defenders should continue to block connections to the IP address 172.64.151.8 and to the full domain name, monitor for any resurrection of the host on other subdomains, and update web filtering and email security policies to flag any references to the page title or the iTrustCapital brand. Organizations using iTrustCapital services should remind users to verify URLs and to avoid entering credentials on sites that do not belong to the official iTrustCapital domain.