citrearewards[.]xyz

This domain, citrearewards.xyz, is identified as a brand impersonation scam specifically targeting cryptocurrency users through a fake airdrop scheme. The site mimics legitimate Citrea token distribution events, presenting itself as an official platform where users can claim free tokens. Analysis indicates the primary threat involves luring victims into connecting their crypto wallets to the site, where malicious smart contracts or phishing scripts can drain funds or harvest sensitive credentials such as private keys and seed phrases. The fraudulent nature of this operation is further evidenced by the site's design, which often includes urgent calls to action, countdown timers, and false claims of limited availability to pressure users into hasty decisions. Infrastructure analysis reveals multiple red flags confirming the domain's malicious intent. The domain was registered on May 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It is flagged by 2 out of 95 security vendors on VirusTotal, and appears on four distinct security blocklists, including MetaMask, PhishDestroy, SEAL, and ScamSniffer. The site resolves to the IP address 172.67.174.41 and employs Cloudflare services, including HSTS and HTTP/3, which are often used to obfuscate malicious infrastructure and evade detection. The page title, 'Airdrop | Citrea,' directly impersonates the legitimate brand, reinforcing the social engineering tactics used to deceive users. If you have visited citrearewards.xyz or interacted with the site, immediate action is required to mitigate potential risks. First, disconnect any crypto wallets that were linked to the domain and revoke any suspicious smart contract approvals using a blockchain explorer or wallet management tool. Scan your device for malware, as phishing sites may deploy malicious scripts or redirect to exploit kits. Monitor your wallet transactions for unauthorized activity and consider transferring assets to a new wallet if you entered sensitive information. Report the domain to relevant security communities and crypto platforms to help prevent further victimization. Users should remain vigilant against similar scams by verifying official airdrop announcements only through trusted sources, such as the project's verified social media channels or official website.