sso-itrust----capital-com-auth[.]webflow[.]io

This domain is flagged as an elevated risk due to brand impersonation aimed at iTrustCapital users. The specific threat type involves a fake login page designed to harvest user credentials under the guise of a legitimate iTrustCapital access portal. Given its targeted nature and the potential financial impact, the risk level is elevated.

Technical analysis reveals critical indicators of fraudulent activity. The domain sso-itrust----capital-com-auth.webflow.io was registered through NameCheap, Inc., known for its less stringent registration processes which can attract malicious actors. The domain resolves to an IP address managed by Cloudflare, Inc. (104.18.36.248), suggesting the use of a popular CDN to obscure the server's origin. Created on February 21, 2026, the domain was quickly identified and listed on a security blocklist by PhishDestroy. VirusTotal analysis shows 17 out of 95 security vendors have flagged this domain, reinforcing its malicious intent. Moreover, the SSL certificate issued by Google Trust Services, while valid, does not guarantee the legitimacy of the site, as phishing domains often exploit the trust associated with HTTPS.

To mitigate the risks associated with this domain, potential targets should be educated on recognizing phishing attempts, particularly those masquerading as trusted brands. Users should verify the authenticity of URLs and avoid entering credentials on suspicious sites. Security professionals should ensure that domain blocklists are up-to-date and consider implementing additional security layers, such as two-factor authentication, to protect user accounts. Monitoring for similar domain patterns and rapid incident response are also crucial in addressing such threats effectively. Furthermore, organizations should report such domains to appropriate authorities to facilitate swift takedown and protect the broader community from financial and data losses.