itrsutcapital-logun[.]webflow[.]io

PhishDestroy identifies the domain itrsutcapital-logun.webflow.io as a confirmed active phishing site impersonating ITRSUT Capital’s brand to harvest sensitive financial data. Threat intelligence confirms this domain is currently engaged in malicious activity designed to deceive users into disclosing login credentials or payment details under the guise of an investment platform. The infrastructure hosting the scam remains operational, indicating an elevated risk to visitors who may inadvertently access the fraudulent page.

This domain was flagged by 15 of 95 VirusTotal security vendors, indicating partial but not universal detection. It is served from IP address 104.18.36.248 and uses a Google Trust Services SSL certificate to enhance credibility. While the exact creation date is not publicly available, the presence of a valid certificate suggests recent setup—common among short-lived phishing operations. The domain is likely hosted on Webflow’s platform, which has been increasingly exploited for low-cost phishing due to its legitimate appearance and rapid deployment capabilities.

Given the active status, elevated risk, and partial detection by security tools, users and organizations are strongly advised to block access to itrsutcapital-logun.webflow.io at the network level and update DNS filters accordingly. Report the domain to your threat intelligence platform and warn stakeholders, particularly those in financial services, about the ITRSUT Capital impersonation. Exercise heightened scrutiny for any unsolicited investment offers referencing ITRSUT Capital and verify all communication through official, verified channels before engaging.