portalbbva[.]mx243[.]com[.]mx

On 23 July 2026, analysis of the domain portalbbva.mx243.com.mx identified it as a confirmed phishing infrastructure. The site’s HTML title field returned the exact string “portalbbva.mx243.com.mx”, providing a clear indicator of its malicious intent. The domain was registered on 21 February 2026, suggesting a short lifespan consistent with typical phishing campaigns. VirusTotal scans returned 15 positive detections out of 93 security vendors, indicating that a substantial portion of commercial scanners flagged the host as malicious.

Independent blocklisting services have also marked the domain; it appears on at least one security blocklist and has been actively blocked by the PhishDestroy anti‑phishing feed. Reputation scoring services further corroborate the threat profile: Gridinsoft assigned a trust score of 0 out of 100, while Scamadviser gave a score of 1 out of 100, both reflecting an extremely low level of legitimacy. The current operational status is offline, which may be the result of takedown actions or the natural expiration of the short‑lived registration. No additional intelligence such as hosting IP, ASN, or SSL certificate details is presently available, leaving the hosting infrastructure uncharacterized.

Defenders should continue to block the domain at perimeter controls, update internal URL filtering lists, and monitor for any re‑registration attempts or look‑alike domains that reuse the “portalbbva” identifier. Because the domain has already been flagged by multiple vendors, automated remediation based on the VirusTotal detection count and blocklist presence is recommended. Ongoing threat‑intel feeds should be consulted for any emerging indicators that associate the same naming pattern with new phishing deployments.