itrusxctcapitllogin[.]webflow[.]io

This domain, itrusxctcapitllogin.webflow.io, is flagged for credential phishing activity specifically designed to mimic the legitimate iTrustCapital login portal. Analysis indicates the page title, 'iTrustCapital® Login | iTrustCapital® Login,' directly impersonates the cryptocurrency investment platform, suggesting an intent to harvest user credentials for unauthorized account access or financial theft. No explicit crypto drainer kit signatures were identified, but the domain’s structure and content align with typical credential harvesting infrastructure targeting financial services users. Infrastructure analysis reveals the following technical indicators: the domain is registered through NameCheap, Inc., and resolves to the IP address 104.18.36.248, hosted on Cloudflare’s network (AS13335). The domain was created on February 24, 2026, though this date may reflect registry manipulation or placeholder data. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, while it appears on a single security blocklist. The SSL certificate is issued by Google Trust Services (WE1), a common characteristic of both legitimate and malicious domains leveraging Cloudflare’s CDN. No Google Safe Browsing (GSB) hits were reported at the time of analysis. The domain has since been taken offline, likely following detection and reporting by security systems, including PhishDestroy. While the immediate threat is mitigated, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations are advised to monitor for credential reuse attempts, particularly targeting iTrustCapital accounts, and to implement multi-factor authentication (MFA) as a mitigating control. Network-level blocking of the IP 104.18.36.248 and domain-based filtering for itrusxctcapitllogin.webflow.io are recommended to prevent residual exposure. Continuous monitoring of related infrastructure, such as domains registered via NameCheap with similar naming conventions, is warranted to identify potential follow-up campaigns.