itrusttcpitlllogin[.]webflow[.]io

Analysis of the domain itrusttcpitlllogin.webflow.io as of July 23, 2026 indicates that the site is associated with credential phishing activity. The domain was created on May 08, 2013 and is registered through MarkMonitor, Inc. It resolves to the IP address 172.64.151.8, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, confirming that the infrastructure is fully fronted by Cloudflare. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming the use of a valid HTTPS certificate. HTTP requests return a 404 status code and the page title reported is “404 - Page not found”, suggesting that the malicious landing page is no longer reachable.

VirusTotal reports that 12 of 95 scanned security vendors flag the domain, reinforcing suspicion of malicious intent. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. Detected technologies include Cloudflare and HTTP/3, which are consistent with the observed infrastructure. The scam classification is listed as credential phishing, but no additional details about the targeted brand or payload are available.

Because the site is currently offline, active exploitation is unlikely, yet the historical presence on blocklists and vendor detections warrants continued monitoring. Defensive teams should ensure that any outbound connections to 172.64.151.8 are logged and, where appropriate, blocked. Adding the domain to internal URL filtering lists and updating web proxy rules to deny traffic to the host will reduce exposure. Ongoing threat intelligence feeds should be consulted for any re‑activation of the domain or emergence of related indicators.