sso--itrustycapitallog--sso-auth[.]webflow[.]io

This domain, sso--itrustycapitallog--sso-auth.webflow.io, was registered through Webflow on March 22 2026. The site resolves to the Cloudflare‑owned address 104.18.36.248, which is geo‑located in Canada and is served behind Cloudflare’s edge network using HTTP/3. The TLS certificate is issued by Google Trust Services under the WE1 identifier, confirming that transport encryption is in place. An HTTP request to the root URL returns a 404 status code, and the only visible metadata is the page title “Welcome to ITrustCapital Login,” which aligns with the classified scam type of credential phishing targeting the ITrustCapital brand.

VirusTotal has recorded 20 positive detections out of 94 submitted scanners, indicating that a notable subset of security vendors recognize the domain as malicious. The domain is presently listed as offline, and PhishDestroy has taken it down; it also appears on a single external blocklist. The technology fingerprint shows the presence of Webflow and Cloudflare, both of which are commonly leveraged by threat actors to host phishing pages because they provide rapid deployment and hide the true origin of the content. Current uncertainties include the exact content that was served before the 404 response, the presence of any credential‑harvesting form, and whether additional infrastructure such as command‑and‑control servers or redirect chains was associated with this domain.

No open‑source intelligence sources beyond the provided data have been identified, and no evidence of malware distribution or other payloads has been observed. Defenders should continue to block the domain at perimeter filters, update URL reputation feeds with the observed detections, and monitor for any new subdomains or similar Webflow‑hosted URLs that reference ITrustCapital. Given the elevated risk rating, organizations that use ITrustCapital services should advise users to verify login URLs and enforce multi‑factor authentication where possible.