itustcapitallogine[.]webflow[.]io

The domain itustcapitallogine.webflow.io is observed as an active credential‑phishing site that imitates the iTrustCapital login portal. The page title reads “iTrustCapital Login - The Crypto IRA Retirement,” a clear indication that the page is designed to deceive users into entering their authentication details.

The domain was created on May 08, 2013 and registered through a well‑known registrar. It is served by two authoritative name servers provided by a large DNS operator. DNS resolution points to IP address 104.18.36.248, an address located in the United States and assigned to an autonomous system commonly used by a global content delivery network. HTTP responses return a 200 status code and the site is protected by a TLS certificate that chains to a trusted root, while also supporting the HTTP/3 protocol.

Reputation metrics assign the domain a trust score of 0 out of 100, and it appears on a single security blocklist. VirusTotal analysis indicates that 15 of 95 scanned security vendors flag the domain as malicious, reinforcing the phishing assessment. Additionally, an established anti‑phishing takedown feed has blocked the domain, confirming its malicious intent.

Given the combination of a legitimate‑looking TLS setup, low trust score, multiple vendor detections, and explicit brand impersonation, the domain presents a high‑risk profile. Defenders should incorporate the exact domain and its IP address into blocking rules, monitor DNS queries to the associated name servers, and alert users that any login interface originating from this host is fraudulent. Credential reuse should be discouraged, and any compromised accounts should be reset promptly.