itrstcapetalogin[.]webflow[.]io

Analysis of itrstcapetalogin.webflow.io confirms it as a credential phishing site impersonating iTrustCapital, a cryptocurrency investment platform. The domain, registered on February 21, 2026, through NameCheap, Inc., was hosted on Cloudflare infrastructure (AS13335) and resolved to IP 172.64.151.8, located in the US. The page title, 'iTrustCapital - Login & Account Information,' directly matches the targeted brand, indicating an intent to deceive users into submitting login credentials. The site was flagged by 16 of 93 security vendors on VirusTotal and appears on the PhishDestroy blocklist, further corroborating its malicious classification.

Infrastructure analysis reveals the use of Cloudflare nameservers (journey.ns.cloudflare.com, lamar.ns.cloudflare.com) and HTTP/3, a common obfuscation tactic to evade detection. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the threat, as phishing sites frequently leverage valid certificates. As of July 23, 2026, the domain returns an HTTP 404 status, suggesting it has been taken offline, though defenders should monitor for reactivation or migration to new infrastructure. Defenders are advised to block the domain and its resolving IP at network and endpoint levels.

Given the use of Webflow as a hosting platform, security teams should also audit other domains on the same service for similar phishing activity. While the exact content of the phishing page remains unanalyzed, the combination of brand impersonation, credential phishing classification, and detection by multiple security vendors provides sufficient evidence for immediate mitigation. No additional scam categorization (e.g., crypto drainer, investment fraud) is confirmed beyond the provided credential phishing designation.