ctr-citrea[.]xyz

Analysis of ctr-citrea.xyz indicates an active, elevated‑risk phishing infrastructure. The domain was registered on May 22, 2026 through Porkbun LLC, a registrar frequently used by malicious actors. VirusTotal scans show that five of ninety‑one security vendors flagged the domain, providing a modest but notable detection signal.

Independent security blocklists have listed the domain three times, and it is currently blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that the site is being used for malicious credential harvesting. The threat type is classified as generic phishing, and the operational status remains active as of the report date, July 29, 2026. No publicly available information on hosting IP, ASN, geographic location, SSL certificate details, or HTTP response codes was supplied, leaving those vectors unverified.

Consequently, defenders should prioritize immediate containment: add ctr-citrea.xyz to DNS and proxy blocklists, enforce network‑level deny rules, and monitor for any outbound connections to the domain. Continuous re‑evaluation is advised, as additional intelligence such as page content, certificate fingerprints, or hosting infrastructure may emerge. Until further artifacts are disclosed, the domain should be treated as a confirmed phishing source and mitigated accordingly.