itrusrtcapiatlogin[.]webflow[.]io

The domain itrusrtcapiatlogin.webflow.io is currently offline, returning HTTP 404. It is hosted behind Cloudflare, utilizes HTTP/3, and serves a TLS certificate issued by Google Trust Services under the WE1 root. The authoritative nameservers are journey.ns.cloudflare.com and lamar.ns.cloudflare.com, and the domain resolves to the IPv6 address 2606:4700:440c::ac40:9708, which belongs to AS13335 Cloudflare, Inc., located in the United States. Registration records show the domain was created on May 08, 2013 and was purchased through MarkMonitor, Inc. VirusTotal analysis indicates that 13 of 95 scanned security vendors flagged the domain, and it appears on at least one public blocklist, where it was also blocked by the PhishDestroy service.

The intelligence categorizes the site as a credential phishing operation, and the risk level has been assigned as elevated. The page title returned by the server is “404 - Page not found”, providing no further content for analysis. Because the site is offline, no active phishing landing page can be examined, and the specific brand or service being spoofed remains unknown. Defenders should continue to block the domain at network perimeter and update URL filtering rules.

Monitoring of related C2 infrastructure or similar subdomains hosted on the same Cloudflare IP range is advised, as the attacker may reactivate the site or shift operations to a new host. Additional investigation should focus on any historic traffic logs that reference the domain, and on correlating the 13 vendor detections for clues about the underlying phishing kit. Until the site is confirmed inactive, maintain the elevated risk posture and ensure user education about unsolicited login requests that could be linked to this domain.