citrea-vote[.]today

This domain, citrea-vote.today, is actively engaged in crypto drainer phishing operations targeting cryptocurrency users. Analysis indicates the domain is currently active and designed to mimic legitimate cryptocurrency voting or reward platforms to facilitate unauthorized transactions and asset theft. No specific brand impersonation has been confirmed, but the domain leverages social engineering tactics common in crypto-related fraud. Infrastructure analysis reveals the domain is registered through IdentityDigital and resolves to the IP address 172.67.171.161. It has been flagged by 5 of 95 security vendors on VirusTotal, indicating moderate but concerning detection rates. The domain appears on three security blocklists and is associated with an SSL certificate issued by Google Trust Services (WE1). No creation date is publicly available, but the domain remains operational and unmitigated at the time of this report. Current status confirms citrea-vote.today is still active and poses a high risk to users. Organizations and individuals are advised to block the domain at the network level and update endpoint protection rules to include the IP address 172.67.171.161. Users should avoid clicking any links associated with this domain or entering credentials on its landing pages. Security teams are recommended to monitor for related indicators, including SSL certificate fingerprints and registrar patterns, to preemptively identify similar threats.