itrustcapitallogugin[.]webflow[.]io

PhishDestroy identifies itrustcapitallogugin.webflow.io as an active credential-harvesting domain impersonating I Trust Capital, posing an elevated risk to users. This domain was flagged by 8 of 95 VirusTotal security vendors, indicating widespread suspicious activity. The site resolves to IP 104.18.36.248 and leverages a Google Trust Services SSL certificate to appear legitimate. Blocked by multiple threat intelligence feeds, it joins a growing list of Webflow-hosted phishing pages targeting financial services.

This domain exhibits multiple red flags aligning with credential-harvesting campaigns. It uses a legitimate hosting platform (Webflow) to evade detection while impersonating I Trust Capital, a trusted financial brand. The presence of a valid SSL certificate from Google Trust Services (notably issued to the domain itself) further increases its deceptive appearance. With 8/95 vendors flagging it and no legitimate association with I Trust Capital, this site clearly aims to trick users into entering login credentials or sensitive financial information.

Users should immediately avoid interacting with this domain and report it to their security teams or browser providers. If credentials were entered, they should be changed immediately and monitored for fraudulent activity. Financial institutions should update blocklists to include itrustcapitallogugin.webflow.io and IP 104.18.36.248. Organizations can deploy DNS filtering to block access to this domain proactively.