iyrustcapytellogin[.]webflow[.]io

This domain, iyrustcapytellogin.webflow.io, is flagged as an active high-risk credential phishing site impersonating iTrustCapital, a known cryptocurrency investment platform. Registered on June 30, 2026, through Webflow, the domain remains operational as of July 12, 2026, and resolves to IP address 172.64.151.8, hosted on Cloudflare's infrastructure (AS13335). Analysis indicates the use of Webflow's hosting platform and Cloudflare's content delivery network, including HTTP/3 support, which may obscure origin server details. The SSL certificate is issued by Google Trust Services (WE1), a common practice for both legitimate and malicious sites leveraging Cloudflare. The page title, 'Login & Account Information – iTrustCapital Login,' explicitly targets iTrustCapital users, suggesting an intent to harvest credentials. No nameservers are currently detected, which may indicate an incomplete or obfuscated DNS configuration. Security vendors have flagged the domain, with 16 of 91 engines in VirusTotal identifying it as malicious, though the absence of additional context limits definitive classification. The domain appears on at least one security blocklist, reinforcing its suspicious status. Defenders should treat this domain as a confirmed phishing threat targeting financial or cryptocurrency account credentials. Immediate mitigation steps include blocking the domain and IP at network and endpoint levels, alerting users to avoid interaction, and monitoring for related infrastructure (e.g., Cloudflare-hosted domains with similar naming patterns). Further investigation into the Webflow account or hosting origin may reveal additional linked phishing campaigns. The exact content and functionality of the site remain unanalyzed, but the combination of brand impersonation, recent registration, and security vendor detections warrants proactive containment.