deploy-preview-476--citrea[.]netlify[.]app

This domain, deploy-preview-476--citrea.netlify.app, is flagged as a high-risk crypto drainer operation targeting cryptocurrency wallet users. Analysis indicates the site impersonates Citrea, a legitimate blockchain scaling solution, to deceive victims into connecting their wallets. The infrastructure appears designed to execute unauthorized transactions, draining assets once wallet permissions are granted. No explicit drainer kit signature has been identified, but behavioral patterns align with known crypto theft frameworks. Infrastructure analysis reveals the domain is hosted on Netlify’s platform and resolves to IP address 63.176.8.218, geolocated in Germany under Amazon.com, Inc.’s AS16509. Security vendors report a detection rate of 2/95 on VirusTotal, with three independent blocklists listing the domain as malicious. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides no inherent protection against fraudulent activity. No historical registration data is publicly available due to Netlify’s hosting model, limiting temporal analysis. The domain remains active as of the latest verification, with no takedown or mitigation measures observed. Response actions by security providers include blocking by PhishDestroy, MetaMask, and SEAL, though these protections may not cover all potential victims. The remaining risk is elevated due to the domain’s continued accessibility, lack of clear attribution, and direct targeting of cryptocurrency holders. Users are advised to avoid interacting with the site, revoke any connected wallet permissions, and monitor transaction histories for unauthorized activity. Cryptocurrency exchanges and wallet providers should preemptively block this domain and associated IP addresses to prevent asset loss.