citrea-allocation[.]xyz

This domain, citrea-allocation.xyz, is identified as a brand impersonation phishing site designed to deceive users by mimicking the legitimate Citrea platform. The site employs visual and structural elements consistent with Citrea’s branding, including an identical page title, "Citrea | Citrea," to create a false sense of authenticity. Such impersonation attacks typically aim to harvest credentials, private keys, or other sensitive information from users under the pretense of legitimate interaction with the targeted brand’s services.

Analysis indicates the domain was registered on May 10, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com. It resolves to the IP address 188.114.96.3 and has been flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on three security blocklists and has been referenced in one threat intelligence pulse on AlienVault OTX. Infrastructure analysis reveals the use of Cloudflare and Cloudflare Browser Insights, alongside HTTP/3, which may be leveraged to obfuscate malicious activity or enhance the site’s perceived legitimacy.

Users who visited citrea-allocation.xyz should immediately revoke any permissions granted to the site, particularly within browser-based cryptocurrency wallets or extensions. All credentials or sensitive information entered on the domain should be considered compromised and updated across all platforms where reused. Monitor accounts associated with the targeted brand for unauthorized activity and enable multi-factor authentication where available. If financial transactions were initiated, contact the relevant financial institution to report potential fraud and initiate recovery procedures.