learn-trst-capital[.]pages[.]dev

This domain is flagged as an active credential theft operation targeting iTrustCapital users. Analysis indicates the site mimics the legitimate iTrustCapital login portal, presenting a high-fidelity replica under the title 'iTrustCapital Sign In | Safe.' The objective appears to be harvesting login credentials for cryptocurrency wallets or investment accounts, enabling unauthorized access to digital assets. Given the targeted nature of the impersonation and the potential for financial loss, the risk level is classified as elevated. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc., and resolves to the IP address 172.66.44.147. The domain was created on November 04, 2025, suggesting recent deployment for this campaign. Detection metrics show minimal coverage, with only 1 of 95 security vendors flagging the domain on VirusTotal. It appears on a single security blocklist, and Gridinsoft assigns a trust score of 0/100. The site employs HSTS and HTTP/3 protocols, leveraging Cloudflare’s infrastructure to obfuscate its origin and enhance perceived legitimacy. The SSL certificate is issued by Google Trust Services, further blending with legitimate web properties. Mitigation for this credential theft campaign requires immediate action from both users and security teams. Users who may have interacted with the domain should rotate passwords for iTrustCapital and any associated financial accounts, enable multi-factor authentication, and monitor for unauthorized transactions. Security teams should block the domain and IP address 172.66.44.147 at the network level, update endpoint detection rules to flag similar impersonation attempts, and conduct internal awareness training to highlight the risks of brand-specific credential theft. Given the domain’s use of Cloudflare, organizations should also monitor for additional subdomains or variations that may emerge under the same infrastructure.