itrustcapitallagin[.]webflow[.]io

Analysis indicates that itrustcapitallagin.webflow.io is an active generic phishing domain targeting users of a crypto IRA platform. The domain was registered on April 01, 2026 through Webflow and resolves to IP address 172.64.151.8, which is hosted by Cloudflare, Inc. in Canada. The site serves HTTP 200 responses and presents a valid SSL certificate issued by Google Trust Services under the WE1 authority. Security telemetry shows that 19 of 94 VirusTotal scanners have flagged the domain, Gridinsoft assigns a trust score of 0/100, and the domain is listed on at least one public blocklist, including PhishDestroy. The page title explicitly references iTrustCapital login, aligning with the reported investment scam scenario. Although the exact content of the page has not been examined, the combination of a recent registration, use of a legitimate‑looking TLS certificate, and multiple security detections strongly suggests malicious intent. Defenders should block DNS resolution for the domain, monitor outbound connections to the associated IP, and consider adding the host to network and email filtering rules. Ongoing observation is advised to capture any payloads or credential harvesting activity that may emerge as the campaign progresses.