my-sso--itrustcapital--com-auth--sso[.]webflow[.]io

This domain, my-sso--itrustcapital--com-auth--sso.webflow.io, is identified as a generic phishing site designed to impersonate the legitimate iTrustCapital cryptocurrency investment platform. Analysis indicates the site presents a fraudulent login portal, likely intended to harvest credentials from unsuspecting users attempting to access their accounts. The domain mimics the structure of a single sign-on (SSO) authentication page, a common tactic to lend credibility to phishing attempts targeting financial services. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 18 out of 95 security vendors on VirusTotal, indicating moderate detection coverage. It is registered through Webflow, a platform frequently abused for hosting phishing content due to its ease of deployment. The domain resolves to the IP address 172.64.151.8, associated with Cloudflare (AS13335), which may obscure the true origin of the malicious infrastructure. The page title is explicitly set to 'Log in,' further reinforcing its deceptive purpose. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. Current status of the domain is active, with no evidence of takedown or remediation at the time of analysis. The risk level is classified as elevated due to the combination of credential harvesting intent, brand impersonation, and the use of a content delivery network to mask its infrastructure. Users are advised to avoid interacting with the domain and to verify the authenticity of any login portal by cross-referencing the URL with the official iTrustCapital website. Organizations should update their blocklists to include this domain and monitor for related indicators of compromise, such as the associated IP address and registrar patterns.