itrustcapitalniclogin[.]webflow[.]io

This domain, itrustcapitalniclogin.webflow.io, is flagged as a high-risk credential phishing site targeting iTrustCapital, a cryptocurrency investment platform. Analysis indicates the domain was created on May 8, 2013, but the subdomain or its malicious use appears recent, as it is currently offline with an HTTP 404 status. Infrastructure analysis reveals the domain resolves to Cloudflare IP 2606:4700:4400::ac40:9708 (AS13335, US) and uses Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com). The SSL certificate is issued by Google Trust Services (WE1), a common choice for both legitimate and malicious sites leveraging Cloudflare's CDN.

Google Safe Browsing explicitly flags this domain for social engineering, aligning with its classification as a credential phishing threat. The domain appears on one security blocklist, and 16 of 95 security vendors on VirusTotal detect it as malicious. The registrar is MarkMonitor, Inc., a provider frequently used for both legitimate and fraudulent domains. No specific phishing kit or additional page content (beyond the 404 error) is confirmed in the available data, though the domain name structure suggests an intent to impersonate iTrustCapital's login portal.

Defenders should treat this domain as compromised and block all resolutions at the DNS level. Given its current offline status, monitoring for reactivation is recommended, particularly if the target organization (iTrustCapital) is within scope. If logs show internal users accessed this domain prior to takedown, initiate credential reset procedures for potentially exposed accounts. The use of Cloudflare hosting and Google Trust Services SSL does not indicate legitimacy, as these services are routinely abused for phishing infrastructure.