sso---itrusstcapital-com-auths[.]webflow[.]io

The domain sso---itrusstcapital-com-auths.webflow.io was observed hosting a page titled “Log in | iTrustCapital”. The page returned HTTP 404, indicating the content is no longer reachable. DNS resolution points to 172.64.151.8, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The SSL certificate is issued by Google Trust Services under the WE1 intermediate, which is typical for sites served through Cloudflare's edge network.

The domain was registered on 21 February 2026 through NameCheap, Inc. VirusTotal scans recorded fifteen detections out of ninety‑five antivirus engines, and the domain appears on a single public blocklist. PhishDestroy has also added it to its blocklist. Technology fingerprints show the use of Cloudflare and HTTP/3. The campaign is classified as credential phishing that impersonates the iTrustCapital brand.

The evidence suggests a short‑lived phishing infrastructure that leveraged a reputable hosting provider to obtain a trusted TLS certificate, then directed victims to a non‑existent login page. Because the domain is currently taken offline, immediate malicious activity is unlikely, but remnants may persist in caches or in compromised client devices that have stored credentials. Defenders should continue to monitor for sightings of the domain or its IP address in network traffic, enforce password reset procedures for any accounts that may have been targeted, and ensure that endpoint detection solutions are updated with the latest indicator of compromise data from the blocklists. Ongoing vigilance is recommended given the elevated risk rating.