citihnwi[.]com

This domain, citihnwi.com, is flagged as an active credential theft site designed to mimic legitimate Citi Bank login portals. Victims who enter their banking credentials on this site risk immediate account compromise, unauthorized transactions, and potential identity theft. The site employs convincing visual elements, including Citi Bank branding and SSL encryption, to deceive users into believing it is authentic. Analysis indicates this is not a generic phishing attempt but a targeted effort to harvest financial login details for fraudulent access to victim accounts. Infrastructure analysis reveals several high-risk indicators. The domain was registered on December 29, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It currently resolves to the IP address 188.114.97.3, which has been linked to other phishing campaigns. Despite its recent creation, only 2 out of 95 security vendors on VirusTotal flag this domain as malicious, suggesting it may evade detection by some security tools. The SSL certificate is issued by Google Trust Services, adding a layer of perceived legitimacy that further increases the risk to unsuspecting users. If you or someone you know has visited citihnwi.com or entered credentials on this site, immediate action is required. First, disconnect the affected device from the internet to prevent further data exfiltration. Next, contact Citi Bank directly using their official customer service channels to report the incident and request account monitoring or a temporary freeze. Change all passwords associated with the compromised account, and enable multi-factor authentication if not already active. Monitor bank statements and credit reports for unauthorized activity, and consider placing a fraud alert with credit bureaus. Finally, scan the device for malware using updated security tools, as credential theft sites often deploy additional payloads to maintain persistence on victim systems.