iitrrustcappitallogin[.]webflow[.]io

The domain iitrrustcappitallogin.webflow.io was registered on March 02, 2026 through Cloudflare, Inc. and is hosted on the Cloudflare network (AS13335) with the IP address 172.64.151.8 located in the United States. The site presents a TLS certificate issued by Google Trust Services under the WE1 root, confirming that standard HTTPS termination is in place. Network analysis shows the service is reachable via HTTP/3, a protocol commonly used by legitimate Cloudflare‑protected sites. When queried, the server returns an HTTP 404 status and the page title “Simplify Your Investment Journey with I Trust Capital Login”, which aligns with the listed scam type of credential phishing.

VirusTotal has recorded 15 positive detections out of 93 scanning engines, indicating that a notable minority of security vendors have identified malicious characteristics. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service, after which the operator appears to have taken the site offline. The current offline status prevents further live interaction, but the historical evidence demonstrates a deliberate attempt to harvest login credentials for an investment‑related brand.

Defenders should continue to monitor the underlying IP range for re‑use, enforce domain‑level blocking for iitrrustcappitallogin.webflow.io, and incorporate the observed page title and TLS fingerprint into detection rules. Because the site is no longer reachable, any ongoing risk is limited to users who may have previously visited the URL; incident response teams should advise affected users to change passwords and review account activity for the targeted brand. Additional investigation is warranted to determine whether the same infrastructure is being reused for other phishing campaigns, given the ease of provisioning new subdomains on the Webflow platform.