citizensmcbank[.]com

The domain citizensmcbank.com was registered on November 22, 2025 through Dynadot LLC and resolves to the IP address 198.23.193.170, which is associated with AS36352 HostPapa in the United States. The domain is currently taken offline, and no SSL certificate was observed during the brief scan, indicating that any traffic would have been transmitted without encryption. The page title returned by the server was "Home - Citizens," matching the brand target listed as "foundation" and confirming the intent to impersonate a legitimate financial institution. Technical fingerprinting showed the presence of Tailwind CSS, LiteSpeed, Alpine.js, Smartsupp, jsDelivr, and HTTP/3, a stack commonly used by commodity phishing kits.

VirusTotal analysis flagged the domain in six of ninety‑five security vendors, and the domain appears on one external security blocklist. Reputation services rated the site poorly, with Scamadviser assigning a trust score of 45 out of 100 and Gridinsoft assigning a score of 0 out of 100. The domain has been added to the PhishDestroy blocklist, reinforcing the view that it was used for a banking phishing campaign. While the site is offline, defenders should continue to block the associated IP address and the two authoritative nameservers dns1.geebytesdns.com and dns2.geebytesdns.com.

Logging any DNS queries for citizensmcbank.com or its hostnames can aid in detecting residual traffic. Since the SSL state was absent, any future re‑hosting of the domain would likely repeat the same insecure pattern, so monitoring for renewed certificate issuance is advisable. The combination of registrar data, hosting information, flagged vendor detections, low trust scores, and the explicit brand impersonation provides a clear indication that the domain was employed for fraudulent banking activities, and network defenders should treat any residual artifacts as malicious.