itrustcapitalelogine[.]webflow[.]io

Analysis of itrustcapitalelogine.webflow.io indicates a credential phishing operation targeting users of the iTrustCapital platform. The domain, registered on February 21, 2026, through NameCheap, Inc., was flagged by 15 of 93 security vendors on VirusTotal, with PhishDestroy actively blocking access. It appears on at least one security blocklist, reinforcing its classification as a phishing threat. Infrastructure analysis reveals the domain resolves to Cloudflare’s IPv6 address 2606:4700:440c::ac40:9708 (AS13335), a common hosting choice for both legitimate and malicious sites.

The SSL certificate, issued by Google Trust Services (WE1), provides encryption but does not validate the site’s legitimacy. The page title, 'iTrustCapital Login | Unleash the Potential of Your Capital with iTrustCapital,' directly mimics the branding of the legitimate iTrustCapital platform, a tactic frequently employed in credential phishing to deceive users. The domain is currently offline, returning an HTTP 404 status, which may indicate takedown efforts or temporary suspension. Technologies detected include Cloudflare and HTTP/3, consistent with modern phishing infrastructure designed to evade detection.

While the exact content of the phishing page remains unanalyzed, the combination of domain registration details, detection by multiple security vendors, and the use of a well-known brand in the page title provides strong evidence of malicious intent. Defenders should treat this domain as compromised and continue monitoring for reactivation or related infrastructure. Blocking access at the network level and alerting users to potential credential theft risks are recommended actions.