g-i-trustcapital--com--auth[.]webflow[.]io

Analysis of g-i-trustcapital--com--auth.webflow.io shows multiple indicators of compromise consistent with a high‑risk generic phishing operation. The domain was registered through the Webflow platform on 13 June 2026, a relatively recent creation date that aligns with the rapid deployment patterns observed for phishing infrastructure. Google Safe Browsing has flagged the domain for social engineering, confirming that it is being used to lure victims into credential‑theft or other malicious activity. Independent blocklist monitoring by PhishDestroy has already listed the domain as malicious, and it appears on one additional security blocklist, reinforcing its reputation as a threat vector.

Technical probing reveals that the domain resolves to IP address 172.64.151.8, an address owned by the Cloudflare network, a common choice for threat actors seeking to obscure origin and benefit from the service’s global edge caching. VirusTotal’s latest scan reports that 15 of 91 security vendors classify the domain as malicious, providing a cross‑vendor consensus that the site hosts or distributes phishing content. No further details on SSL configuration, HTTP response codes, or page titles are currently available, leaving the exact payload and user‑facing experience unverified.

Given the convergence of registrar, safe‑browsing, blocklist, and multi‑vendor detections, defenders should treat the domain as actively malicious. Immediate mitigation steps include adding the domain to network denylists, updating endpoint protection signatures to reflect the 15 vendor detections, and monitoring DNS queries for repeated resolution to 172.64.151.8. Continuous re‑evaluation is advised, as additional intelligence such as page content analysis or further vendor scans could provide deeper insight into the phishing campaign’s scope and targets.