itrfustcapitallogin[.]webflow[.]io

The domain itrfustcapitallogin.webflow.io was identified as a credential phishing site designed to harvest banking login credentials. Analysis indicates the page impersonated a financial institution login portal to deceive users into submitting sensitive authentication details. The domain is currently offline, though it previously operated as an active threat endpoint. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on March 02, 2026, with resolution to IP address 104.18.36.248 (AS13335, United States). The SSL certificate was issued by Google Trust Services (WE1). At the time of detection, the domain was flagged by 16 of 95 security vendors on VirusTotal and appeared on one security blocklist. The page title, '404 - Page not found,' suggests either an attempt to evade detection or a temporary placeholder during the phishing campaign lifecycle. Current status indicates the domain has been taken offline, though residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations are advised to block the domain and associated IP address at the network perimeter. End users should reset credentials if they entered login details on this site, enable multi-factor authentication on financial accounts, and verify the legitimacy of any unexpected login prompts. Security teams should monitor for indicators of compromise linked to this campaign, including the domain, IP, and SSL certificate fingerprint.