bancolombiafinanciaciondirecta[.]zeabur[.]app

This domain, bancolombiafinanciaciondirecta.zeabur.app, poses a brand_impersonation threat specifically targeting Bancolombia customers through a fraudulent virtual branch portal. The site mimics the legitimate Bancolombia Sucursal Virtual Personas interface, attempting to harvest credentials and sensitive financial information from unsuspecting users. Analysis indicates the domain is designed to exploit trust in the Bancolombia brand, leveraging visual and structural similarities to deceive visitors into entering login details or personal data. Infrastructure analysis reveals multiple red flags corroborating the malicious nature of this domain. The domain was registered on September 27, 2022, through GoDaddy.com, LLC, and is flagged by 18 out of 95 security vendors on VirusTotal. It appears on one security blocklist and resolves to the IP address 43.159.166.10, hosted under AS132203 in a data center linked to Tencent Building, Kejizhongyi Avenue. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as fraudulent domains frequently use valid certificates to appear legitimate. Users who visited bancolombiafinanciaciondirecta.zeabur.app should take immediate action to mitigate potential risks. Those who entered credentials or personal information should assume their data has been compromised and initiate account recovery procedures with Bancolombia through official channels. It is recommended to monitor financial statements for unauthorized transactions and update passwords for any accounts where the same credentials may have been reused. Additionally, affected users should scan their devices for malware, as phishing sites often deploy malicious payloads to maintain persistence or exfiltrate further data. Organizations should update their security blocklists to include this domain and its associated indicators to prevent future access.