bancolombiaprestamosonline[.]zeabur[.]app

This domain is assessed as elevated risk and is associated with brand_impersonation targeting Bancolombia. Analysis indicates that the infrastructure was configured to present the page title "Bancolombia Sucursal Virtual Personas," a strong indicator of attempted identity mimicry designed to mislead users into believing they are interacting with a legitimate online banking portal. Although the current status is offline and the site has been taken offline, the historical indicators remain relevant because brand-impersonation campaigns often reuse infrastructure, themes, and hosting patterns across future operations.

Infrastructure analysis reveals that the domain bancolombiaprestamosonline.zeabur.app resolved to IP address 43.159.166.10 and was associated with an IP location in the US under AS132203 Tencent Building, Kejizhongyi Avenue. Registration records indicate creation on September 27, 2022, through GoDaddy.com, LLC. Certificate data identified Google Trust Services / WR1 as the SSL certificate issuer. Security telemetry shows the domain appears on 1 security blocklist and is specifically blocked by PhishDestroy. Reputation assessment further indicates that 19 out of 95 security vendors on VirusTotal flag the domain. The combination of a financial-brand-themed page title, brand targeting, security detections, and blocklist presence increases confidence that the infrastructure was used for deceptive activity.

Recommended mitigation focuses on brand-impersonation risk. Users and defenders should treat any historical links, messages, or redirects associated with this domain as untrusted. Security teams should maintain blocks for the domain and resolved IP address where appropriate, review logs for past connections, and investigate any credential-entry events potentially linked to the impersonated brand. Email, web-filtering, and DNS controls should be updated to prevent access to related infrastructure. Organizations monitoring fraud activity should track lookalike naming patterns, certificate reuse, hosting overlaps, and future registrations that imitate the same brand identity.