itrustcapital-login[.]webflow[.]io

This domain, itrustcapital-login.webflow.io, operates as a credential phishing portal targeting users of the legitimate iTrustCapital cryptocurrency IRA platform. Analysis of the page reveals a near-identical replica of the official iTrustCapital login interface, designed to harvest usernames, passwords, and potentially multi-factor authentication codes. The site specifically exploits the growing interest in retirement-linked crypto investments, a niche that increases the likelihood of successful credential theft from financially motivated victims. Given the domain's focus on crypto IRA accounts, compromised credentials could lead to unauthorized asset transfers or account takeovers, amplifying the financial impact on affected users. Infrastructure analysis provides multiple indicators of malicious intent. The domain was registered through NameCheap, Inc. on February 21, 2026, a future date that suggests domain spoofing or improper registration metadata. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious, while it appears on at least one security blocklist. The site resolves to IP address 104.18.36.248, hosted under AS13335 (Cloudflare, Inc.), a common obfuscation tactic used to conceal the true origin of phishing infrastructure. The SSL certificate, issued by Google Trust Services (WE1), further mimics legitimate services to evade user suspicion. Users who visited itrustcapital-login.webflow.io should immediately revoke any active sessions on their legitimate iTrustCapital accounts and change their passwords using a secure device. Multi-factor authentication should be enabled if not already active, and users should monitor their accounts for unauthorized transactions or configuration changes. Any credentials entered on the site should be considered compromised and must not be reused across other platforms. Financial institutions and crypto asset custodians should be notified if suspicious activity is detected. Organizations are advised to block the domain and associated IP address (104.18.36.248) at the network perimeter to prevent further exposure.