itrusticards[.]com

This domain, itrusticards.com, is identified as a credential theft operation specifically targeting users of Trust Card, a financial services brand. The site presents itself as an official Trust Card portal, employing deceptive login interfaces to capture sensitive user credentials, including usernames, passwords, and potentially multi-factor authentication codes. Analysis of the domain's infrastructure and content indicates a deliberate attempt to exploit trust in the brand, with the likely goal of unauthorized account access or subsequent fraudulent transactions. The use of financial-themed phishing is particularly concerning due to the high-value targets and potential for significant monetary loss or identity theft for affected individuals. Evidence supporting this assessment includes detection by 16 out of 95 security vendors on VirusTotal, indicating broad recognition of malicious intent. The domain was registered on April 23, 2026, through Name SRS AB, a registrar frequently associated with abusive registrations. Infrastructure analysis reveals the domain resolves to IP address 172.67.157.101 and employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, to obfuscate its true origin and evade detection. The domain appears on one security blocklist and has been flagged by independent threat intelligence sources, further corroborating its malicious nature. The creation date, combined with the use of anonymization technologies, suggests a calculated effort to maintain operational security while conducting fraudulent activities. Users who visited itrusticards.com or entered credentials on the site should assume their login information has been compromised. Immediate action is required, including changing passwords for the affected account and any other services where the same credentials may have been reused. Enable multi-factor authentication on all financial and sensitive accounts to add an additional layer of security. Monitor account statements for unauthorized transactions and report any suspicious activity to the legitimate financial institution. If personal or financial information was disclosed beyond credentials, consider placing a fraud alert or credit freeze with relevant credit bureaus. Organizations should update their security blocklists to include this domain and its associated IP address to prevent further access attempts.