itrrustcaptllogin[.]webflow[.]io

This domain, itrrustcaptllogin.webflow.io, is a credential phishing site designed to steal login credentials for self-directed IRA accounts. The page mimics the legitimate iTrustCapital login portal, tricking users into entering sensitive financial information such as usernames, passwords, and potentially two-factor authentication codes. Credential phishing of this nature can lead to unauthorized account access, financial theft, and identity fraud, particularly targeting individuals managing retirement funds through digital platforms. Analysis indicates the domain was registered on March 04, 2026, through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains. The site resolves to IP address 104.18.36.248, hosted on Cloudflare infrastructure (AS13335), which is frequently leveraged to obscure malicious activity. Security vendors have flagged the domain, with 19 out of 95 engines on VirusTotal detecting it as malicious. Additionally, the domain appears on one security blocklist and has been taken offline following reports of fraudulent activity. If you visited itrrustcaptllogin.webflow.io or entered any credentials, immediate action is required. First, change the passwords for your IRA and any other financial accounts, especially if you reuse credentials. Enable multi-factor authentication where available to add an extra layer of security. Monitor your accounts for unauthorized transactions or suspicious activity, and report any anomalies to your financial institution. Consider placing a fraud alert or credit freeze with major credit bureaus to prevent identity theft. Finally, scan your device for malware to ensure no additional threats were introduced during the visit.