quests-citrea[.]xyz

This domain, quests-citrea.xyz, is identified as an active cryptocurrency phishing site designed to harvest wallet credentials and private keys from unsuspecting users. Analysis indicates the site mimics legitimate cryptocurrency reward or airdrop platforms, employing social engineering tactics to prompt victims into entering sensitive information. The absence of an SSL certificate further increases the risk of data interception during transmission, exposing users to credential theft and financial loss. Infrastructure analysis reveals the domain was registered on May 25, 2024, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. The site resolves to the IP address 104.21.33.12, hosted on Cloudflare’s network (AS13335), which is commonly leveraged to obfuscate the true origin of phishing infrastructure. Detection metrics confirm its malicious nature, with 4 out of 95 security vendors on VirusTotal flagging the domain as phishing-related. Additionally, the domain appears on three security blocklists, including high-confidence threat feeds, further validating its classification as a high-risk threat. Users who have visited quests-citrea.xyz or interacted with its content are advised to take immediate action. First, revoke any wallet permissions or authorizations granted to the domain via connected applications. Second, monitor all linked accounts for unauthorized transactions and enable multi-factor authentication where available. Third, scan local devices for malware, as phishing sites may deploy additional payloads. If credentials were entered, assume they are compromised and transfer assets to a new, secure wallet. Finally, report the domain to relevant security teams to aid in takedown efforts and prevent further victimization.