private-citadel[.]app

Analysis of private-citadel.app indicates a brand impersonation domain targeting Discord users, classified as an elevated-risk threat. The domain was registered on January 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolved to IP 172.67.182.61, hosted on Cloudflare's network (AS13335). The page title, 'Citadel Gaming – Enter the Citadel. Become a Champion,' suggests an attempt to lure users with gaming-related incentives, aligning with the reported scam type of social media phishing.

Security vendors have flagged this domain on three blocklists, including PhishDestroy, MetaMask, and SEAL, while Gridinsoft assigns a trust score of 0/100. VirusTotal reports six detections from 93 security vendors, though the specific nature of these detections remains unconfirmed. The domain's SSL certificate is issued by WE1, a common provider for both legitimate and malicious sites, offering no definitive classification. As of July 23, 2026, private-citadel.app is offline, but its infrastructure and historical indicators remain relevant for defenders.

Organizations should treat this domain as malicious and block it at the network level, particularly in environments where Discord or gaming-related services are used. No evidence confirms the exact phishing kit or payload delivered, but the combination of brand impersonation, low trust scores, and blocklist presence justifies proactive mitigation. Further investigation into associated IPs, registrar patterns, and certificate reuse may uncover related threats.