citiuniononline[.]com

Analysis of the domain citiuniononline.com reveals infrastructure consistent with a banking phishing campaign targeting Citi Prime Trust, as indicated by the page title 'Home - Citi Prime Trust' and the scam type classification. The domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 216.244.83.203, hosted on AS27323 (Wowrack.com) in the United States. No SSL certificate is present, increasing the likelihood of insecure data transmission. Nameservers are configured as vivid1.gfireservers.in and vivid2.gfireservers.in, which may be associated with other malicious infrastructure.

Detection data shows the domain is flagged by six of 93 security vendors on VirusTotal and appears on one security blocklist, specifically PhishDestroy. The Gridinsoft trust score of 0/100 further supports its classification as high-risk. Technologies detected on the domain include Tailwind CSS, LiteSpeed, Alpine.js, jsDelivr, GetButton, and HTTP/3, which are commonly used in both legitimate and phishing sites but provide no inherent indication of intent. As of July 25, 2026, the domain is offline, though its prior activity and infrastructure remain relevant for threat intelligence purposes.

Defenders should treat this domain as part of a confirmed phishing operation targeting financial institutions. Network-level blocking of the IP 216.244.83.203 and associated nameservers is recommended, along with monitoring for re-registration or reuse of the same infrastructure. The absence of an SSL certificate and the use of a recently registered domain align with typical phishing tactics, though the exact content and functionality of the site remain unanalyzed due to its offline status.