home-itrustcapital-com-cdn[.]weebly[.]com

This domain, home-itrustcapital-com-cdn.weebly.com, has been identified as a crypto credential theft operation impersonating iTrustCapital, a cryptocurrency investment platform. The domain is currently offline, though prior analysis confirms its use in malicious credential harvesting campaigns targeting users of the legitimate service. Infrastructure and content patterns align with known tactics for stealing wallet credentials and two-factor authentication codes. Analysis indicates the domain was flagged by 17 of 95 security vendors on VirusTotal, with additional detections by two independent blocklists. It was registered through Safenames Ltd and resolves to the IP address 74.115.51.8, hosted on AS27647 (Weebly, Inc.) in the United States. The domain was originally created on March 29, 2006, though the malicious subdomain appears to have been deployed recently. A Let’s Encrypt SSL certificate (serial number E8) was issued, providing a false sense of legitimacy. Google Safe Browsing classified the domain as phishing, and the page title returned a 404 error, suggesting either takedown or evasion attempts. The domain’s current offline status reduces immediate risk, but historical activity and infrastructure warrant continued monitoring. Organizations should block the domain and its resolved IP (74.115.51.8) at the perimeter, update endpoint detection rules to flag related indicators, and alert users to verify URLs before entering credentials. Given the impersonation of a financial service, users who may have interacted with this domain should rotate passwords, enable multi-factor authentication, and review account activity for unauthorized transactions.