secure-itrust-capital-io[.]square[.]site

This domain is flagged as an elevated-risk credential phishing site targeting users of a cryptocurrency investment platform. Analysis indicates the infrastructure was designed to mimic legitimate login portals, leveraging deceptive page titles such as 'Login | Itrustcapital Login | Secure | Itrustcapital login' to harvest account credentials. The threat type is narrowly scoped to credential theft, with no evidence of malware distribution or secondary payload delivery at this time.

Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 21, 2026, through MarkMonitor, Inc., an atypical registrar for phishing sites, which may have delayed initial detection. It resolves to IP address 74.115.51.4, hosted on AS27647 (Weebly, Inc.), a provider frequently abused for phishing campaigns due to its low-cost hosting and SSL certificate issuance. Security vendors on VirusTotal flagged the domain as malicious, with 17 out of 95 engines detecting it. The domain appears on one security blocklist and is currently offline, though historical SSL certificates (Let's Encrypt / E7) suggest prior active exploitation. The combination of a future creation date (likely a data entry error or spoofed record) and low detection volume indicates a targeted or recently deployed campaign.

Mitigation requires immediate action from both end-users and security teams. Users who accessed the domain should assume credential exposure and initiate password resets for any associated accounts, prioritizing financial and cryptocurrency platforms. Security teams should block the domain and IP address at the network perimeter, along with monitoring for SSL certificates issued to similar subdomains under square.site. Given the use of a legitimate hosting provider, organizations should review logs for connections to 74.115.51.4 or AS27647 to identify compromised endpoints. Additionally, phishing awareness training should emphasize scrutinizing subdomains and page titles, particularly for financial services, as attackers increasingly abuse trusted platforms to evade detection.