citichain[.]network

Analysis indicates that citichain.network is currently active and classified as a high‑risk banking phishing site. The only visible page element is the title “Just a moment…”, and the server responds with HTTP 403, suggesting intentional access restriction. The domain appears on one security blocklist and is listed as blocked by a dedicated phishing mitigation service, confirming its malicious intent.

Infrastructure observation shows that the domain resolves to 172.67.215.63, an address owned by a large content‑delivery network provider with an ASN of 13335 located in the United States. The authoritative nameservers are lovisa.ns and noel.ns, both bearing the CDN provider’s naming pattern, indicating that the site benefits from CDN caching and DDoS mitigation. TLS termination is performed by a widely trusted public certificate authority, as evidenced by a Google‑issued certificate (WE1) that supports HTTP/3, a modern transport protocol.

Threat intelligence corroborates the phishing classification: two out of ninety‑five VirusTotal scanners have flagged the domain, and the Gridinsoft trust score is 0 out of 100, both metrics aligning with malicious behavior. The blocklist entry and the PhishDestroy containment further demonstrate that security vendors have observed abuse linked to this host. No additional context about the page’s content or the specific banking targets is available beyond the generic “Just a moment…” title.

Defenders should immediately block DNS resolution and HTTP traffic to citichain.network at perimeter and endpoint layers. Continuous monitoring of the associated IP address and its ASN is advised, as the CDN infrastructure can be repurposed for other malicious campaigns. Where possible, sinkholing the domain or redirecting requests to a safe‑browse page can mitigate user exposure. Given the limited public information on the payload, ongoing threat‑intel feeds should be consulted for any emerging indicators tied to this domain.