# PhishDestroy domain threat record: bdvcredienlinea-7--servcios.replit.app

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/bdvcredienlinea-7--servcios.replit.app/
Machine-readable companion: https://phishdestroy.io/domain/bdvcredienlinea-7--servcios.replit.app/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-17 03:06:04 UTC
- Last availability or vendor check: 2026-10-22 10:06:04 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 15/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Linea

## Stored infrastructure

- Observed IP address: 34.117.33.233
- Registrar in stored WHOIS data: Replit
- Last stored HTTP status: 301
- Registration date (registry RDAP, replit.app): 2021-04-16 20:44:58 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a7ba-7fed-74ed-8093-7acf0cc359df/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/bdvcredienlinea-7--servcios.replit.app
- Certificate Transparency search: https://crt.sh/?q=%25.bdvcredienlinea-7--servcios.replit.app
- Web Archive lookup: https://web.archive.org/web/*/https://bdvcredienlinea-7--servcios.replit.app/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
This is a phishing page hosted on a Replit app subdomain. Its page title is "Banco de Venezuela," and its address mimics that bank's online credit service, so it targets BDV customers who bank online. PhishDestroy first saw it on 2026-09-17. On 2026-10-19 the site was still alive and responding with a redirect. We classify the impersonated brand as Linea, while the page title and urlscan.io's brand detection both point to Banco de Venezuela.

How the scam works
Pages like this copy a bank's login screen and are usually spread through links in SMS, WhatsApp, social media ads or fake "credit approval" messages. Words like "credienlinea" and a misspelled "servcios" in the address make the link look like an official online-credit portal at a glance. The victim enters a username, password and often one-time codes or card details, and these go straight to the operators. They can then log into the real account, move money or apply for credit in the victim's name.

Evidence
On 2026-09-19, 15 of 89 VirusTotal engines flagged the address. The vendors included BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, G-Data, Emsisoft, Gridinsoft and alphaMountain.ai. That is a broad spread of independent vendors for a single free-hosted page. urlscan.io returned a malicious verdict and recognised Banco de Venezuela branding on the page. The domain is listed on the PhishDestroy blocklist.

Infrastructure
The page runs on Replit's app-hosting platform, served from Google LLC infrastructure in the US, with a Google Trust Services certificate. The 2021-04-16 registration date belongs to the shared replit.app domain, so it says nothing about when this operator set up the page. Free developer hosting lets phishers launch a bank lookalike within minutes under a trusted padlock and a reputable network. That is why the browser's HTTPS indicator gives no assurance here.

What to do
If you entered your Banco de Venezuela credentials on this page, change your online banking password immediately from the official app or website. Call the bank to report possible fraud and ask them to review recent transactions. If you shared card details or one-time codes, have the card blocked and watch your statements for unfamiliar charges or credit requests. Do not reuse that password anywhere else. Security teams should block this hostname and report it to Replit's abuse team. They should also warn Venezuelan banking customers that BDV-themed links on replit.app subdomains are not official.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a7ba-7fed-74ed-8093-7acf0cc359df/
VirusTotal report: https://www.virustotal.com/gui/domain/bdvcredienlinea-7--servcios.replit.app
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=bdvcredienlinea-7--servcios.replit.app
Archived copy: https://web.archive.org/web/20260917031640/https://bdvcredienlinea-7--servcios.replit.app/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:41:19 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a7ba-7fed-74ed-8093-7acf0cc359df.png
  Captured: 2026-09-17 03:06:04 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0a7ba-7fed-74ed-8093-7acf0cc359df.png
  Captured: 2026-09-18 03:30:17 UTC
  Source report: https://urlscan.io/result/01a0a7ba-7fed-74ed-8093-7acf0cc359df/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c69a6fda-8ea2-452e-863d-39d98ebe87b3.png
  Captured: 2026-09-17 03:08:38 UTC
  Source report: https://radar.cloudflare.com/scan/c69a6fda-8ea2-452e-863d-39d98ebe87b3
  SHA-256: 4dfbda2e509f0ecd168a2f4149b0d498ac8e90d295e03708c36bfb87aafb5840
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0ad59-018e-766d-9074-c0d4a1ab4615.png
  Captured: 2026-09-17 03:11:32 UTC
  Source report: https://urlscan.io/result/01a0ad59-018e-766d-9074-c0d4a1ab4615/
  SHA-256: 2a77edfe78f1f46132a38c77be3249df88eb58c410d7f39b09a12449c56a0aeb
- URLScan · 2026-09-18: https://screenshots.phishdestroy.io/us/01a0b2d3-c4da-716b-be65-f6f507a166d3.png
  Captured: 2026-09-18 04:43:53 UTC
  Source report: https://urlscan.io/result/01a0b2d3-c4da-716b-be65-f6f507a166d3/
  SHA-256: 19ac24c07be94fa27c05ea1e669115b764d5faeb5199d900f4af59760384cdb9
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bca4-6a30-77e8-933e-5571124a4ceb.png
  Captured: 2026-09-20 02:28:13 UTC
  Source report: https://urlscan.io/result/01a0bca4-6a30-77e8-933e-5571124a4ceb/
  SHA-256: 2a77edfe78f1f46132a38c77be3249df88eb58c410d7f39b09a12449c56a0aeb
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cc97-61a9-777b-923f-5baf725c2a5f.png
  Captured: 2026-09-23 04:48:04 UTC
  Source report: https://urlscan.io/result/01a0cc97-61a9-777b-923f-5baf725c2a5f/
  SHA-256: e75825bb50c40bf08f9c5f19c02708d7c67158eb17988ae7a99983e4637a2212

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T23:46:36Z",
        "uuid": "01a0a7ba-7fed-74ed-8093-7acf0cc359df",
        "scanned_at": "2026-09-16T01:00:18Z",
        "final_url": "https://bdvcredienlinea-7--servcios.replit.app/",
        "status": 200,
        "ip": "34.117.33.233",
        "ptr": "233.33.117.34.bc.googleusercontent.com",
        "domains": [
            "replit-cdn.com",
            "images.seeklogo.com"
        ],
        "ips": [
            "35.190.3.23",
            "188.114.97.3",
            "34.117.33.233"
        ],
        "asns": [
            "396982",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "play.google.com"
        ],
        "doc_hash": "f41a0528266e2bdb01fffb0f16e6e92fac3d92a69650fe7427c878c04233a340",
        "cookies": [
            "GAESA"
        ],
        "tls": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WR3",
            "subject": "replit.app",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-01T12:25:50Z",
            "valid_from": "2026-09-02T11:30:15Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 0,
        "tls_age_days": 13,
        "tls_valid_days": 90,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 99,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "bancodevenezuela"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Banco de Venezuela"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "Google Frontend",
            "content-type": "text/html; charset=UTF-8",
            "x-powered-by": "PHP/8.2.0RC7",
            "strict-transport-security": "max-age=63072000; includeSubDomains"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:22:07Z",
        "uuid": "c69a6fda-8ea2-452e-863d-39d98ebe87b3",
        "scanned_at": "2026-09-17T03:08:38Z",
        "final_url": "https://bdvcredienlinea-7--servcios.replit.app/",
        "status": 200,
        "history": [
            {
                "url": "https://bdvcredienlinea-7--servcios.replit.app/",
                "status": 200
            }
        ],
        "dom_hash": "ec47d07e52a59508755522dd59f30f933059ca9ca218f30c1dd1eab66981d766",
        "doc_hash": "f41a0528266e2bdb01fffb0f16e6e92fac3d92a69650fe7427c878c04233a340",
        "phishing_v2": [
            "phishing"
        ],
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "bdvcredienlinea-7--servcios.replit.app",
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dnssec_valid": false,
        "ip": "34.117.33.233",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "Nom-IQ Limited dba Com Laude",
            "created": "2021-04-16T20:44:58Z",
            "updated": "2025-10-10T03:54:10Z",
            "expires": "2034-04-16T20:44:58Z",
            "nameservers": [
                "ns-cloud-b1.googledomains.com",
                "ns-cloud-b2.googledomains.com",
                "ns-cloud-b3.googledomains.com",
                "ns-cloud-b4.googledomains.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T07:39:28Z",
        "analysis_at": "2026-10-16T03:49:04Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 15,
            "suspicious": 0,
            "undetected": 32
        },
        "detections": {
            "DNS8": "phishing",
            "ESET": "phishing",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "tags": [
            "dga"
        ],
        "created": "2021-04-16T00:00:00Z",
        "updated": "2025-12-04T00:00:00Z",
        "first_seen": "2026-09-13T08:20:35Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "34.117.33.233"
            }
        ],
        "dns_at": "2026-10-16T04:17:44Z",
        "jarm": "29d3fd00029d29d00042d43d00041d6f940079659edb62e1c38c38bd26ee84",
        "cert": {
            "san": [
                "replit.app",
                "*.replit.app"
            ],
            "issuer": "Google Trust Services / WR3",
            "serial": "b3df8d4daf091430a5fcdb9944aa352",
            "sha256": "4a74494d584027de8f1b50d93d1683733368fbaea4298191709beefd53e0b0ae",
            "subject": "replit.app",
            "valid_to": "2026-12-01T12:25:50Z",
            "valid_from": "2026-09-02T11:30:15Z"
        },
        "whois": []
    }
}
```