i-sso--itrustcapital--com-auth--h[.]webflow[.]io

Analysis of i-sso--itrustcapital--com-auth--h.webflow.io shows that the domain is actively being used for malicious purposes. The domain resolves to the IP address 104.18.36.248, which belongs to a Cloudflare edge server, a common hosting platform for compromised or abused sites. Registration details indicate the domain was created through the Webflow service, a legitimate website builder that can be leveraged to host phishing pages. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy, demonstrating that at least one reputable anti‑phishing organization has taken action against it.

Google Safe Browsing classifies the site as a social engineering threat, reinforcing the suspicion of credential‑harvesting activity. VirusTotal scans have resulted in 15 of 91 security vendors flagging the domain, providing independent corroboration of its malicious nature. No nameserver records were returned, which may indicate use of default or obscured DNS settings to hinder attribution. The available evidence does not include a page title, SSL certificate details, HTTP response codes, or additional threat intelligence such as OTX references, limiting the depth of the current profile.

Defenders should block outbound connections to 104.18.36.248 and add i-sso--itrustcapital--com-auth--h.webflow.io to URL filtering policies. Monitoring for login attempts to the domain and correlating with user reports is advised. Organizations using Webflow for legitimate purposes should audit their subdomains and ensure proper access controls, as the platform can be abused to host phishing infrastructure. Continuous re‑evaluation of the domain’s status on blocklists and threat feeds is recommended, as further indicators may emerge as the campaign evolves.