itrustcapital-loginn[.]webflow[.]io

The domain itrustcapital-loginn.webflow.io was registered through MarkMonitor, Inc. and resolves to the Cloudflare address 104.18.36.248, an IP located in the United States and announced by ASN AS13335 (Cloudflare, Inc.). The site presented a TLS certificate issued by Google Trust Services under the WE1 label, confirming the use of standard HTTPS termination. Google Safe Browsing identified the domain as a social engineering vector, and the phishing kit was subsequently blocked by PhishDestroy and listed on a single security blocklist. VirusTotal analysis shows that 15 of 95 scanned security vendors flagged the domain, indicating moderate detection consensus.

The observed page title, "iTrustcapital login | Sign In," aligns with the declared scam type of credential phishing, targeting users who may attempt to enter login credentials for iTrustcapital. Infrastructure scans revealed the use of Cloudflare services and HTTP/3 protocol, with nameservers journey.ns.cloudflare.com and lamar.ns.cloudflare.com. The domain was created on May 08, 2013, but the current HTTP response is a 404 status, and the overall status is reported as offline as of the July 23, 2026 report date.

While the site is presently inactive, the combination of registrar data, hosting details, SSL issuance, Safe Browsing flag, blocklist entry, and multi‑vendor detections provides a clear indication of malicious intent. Defenders should continue to block the domain at DNS and proxy layers, monitor for any re‑activation or similar sub‑domains, and incorporate the observed indicators—IP address, nameservers, certificate issuer, and page title—into threat‑intel feeds. Ongoing vigilance is advised because the infrastructure (Cloudflare front‑end) could be repurposed for future credential‑theft campaigns.