# PhishDestroy domain threat record: cl-service.is

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/cl-service.is/
Machine-readable companion: https://phishdestroy.io/domain/cl-service.is/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-14 21:22:38 UTC
- Last availability or vendor check: 2026-10-22 10:27:07 UTC
- Stored record updated: 2026-10-22 16:07:29 UTC
- VirusTotal detections in the stored snapshot: 11/91
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: bancocontinental

## Stored infrastructure

- Observed IP address: 172.67.183.178
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 403
- Registration date (registry RDAP, cl-service.is): 2026-07-14 14:55:02 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a1cd-0a5f-7124-bdbf-d1f23fd9d3b3/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/cl-service.is
- Certificate Transparency search: https://crt.sh/?q=%25.cl-service.is
- Web Archive lookup: https://web.archive.org/web/*/https://cl-service.is/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
cl-service.is impersonates Banco Continental. It presents itself under the page title "Continental" to look like the bank's own service portal. Its targets are the bank's customers, especially anyone who reaches it through a link in a text message, email or chat claiming their account needs attention. PhishDestroy first flagged it on 2026-09-14. As of 2026-10-19 the site is still online, and its content remains reachable behind a protection layer.

How the scam works
Bank impersonation pages copy the look and wording of the real login screen, which here is branded "Continental." A victim lured by an urgent message about a blocked account, a suspicious transfer or a required update types in their username and password. Many such pages then ask for one-time codes, card numbers or identity details. The operators use these credentials quickly to log in to the real account, approve transfers or enroll new devices. The victim can lose both account access and the money in it.

Evidence
On 2026-09-25, 11 of 91 VirusTotal engines flagged the domain. The flagging vendors include alphaMountain.ai, BitDefender, CRDF, CyRadar, Forcepoint ThreatSeeker, Fortinet, G-Data and Gridinsoft. That spread across independent vendors is meaningful for a site this new, though most engines had not yet caught up. urlscan.io rated the page malicious and recognised the Banco Continental branding on it, which directly supports the impersonation classification. The domain also appears in four AlienVault OTX threat pulses and is listed on the PhishDestroy blocklist.

Infrastructure
The domain was registered on 2026-07-14, about two months before PhishDestroy detected it. That kind of gap is common when a phishing domain is prepared in advance and then activated for a campaign. The site is served through Cloudflare's network, on an address geolocated to Canada, so the true origin server is hidden behind the proxy. The neutral "cl-service" name on an .is domain carries no bank branding, which lets the link pass a quick glance in a message.

What to do
If you entered your Banco Continental login on this site, change your password immediately through the bank's official app or website, not through any link you received. Then call the bank to report the exposure. Ask the bank to review recent transactions, block any card details you typed in, and reset any one-time-code or device enrollments made after your visit. Watch for follow-up calls or messages posing as the bank's fraud team, which often come next. Defenders should block cl-service.is at the DNS and proxy level and search mail and SMS logs for links to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a1cd-0a5f-7124-bdbf-d1f23fd9d3b3/
VirusTotal report: https://www.virustotal.com/gui/domain/cl-service.is
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=cl-service.is
Archived copy: https://web.archive.org/web/20260914212446/https://cl-service.is/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:58:05 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/0yPbPpSN/121739709e09.png
  Captured: 2026-09-14 21:23:42 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0a1cd-0a5f-7124-bdbf-d1f23fd9d3b3.png
  Captured: 2026-09-14 21:23:42 UTC
  Source report: https://urlscan.io/result/01a0a1cd-0a5f-7124-bdbf-d1f23fd9d3b3/
- URLScan capture 2: https://urlscan.io/screenshots/01a077ba-3cd0-7766-8c64-ef39c594e848.png
  Captured: 2026-09-14 21:22:38 UTC
  Source report: https://urlscan.io/result/01a0a1cd-0a5f-7124-bdbf-d1f23fd9d3b3/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/7a3981be-4daf-49ed-88d1-8e5f4ac5dfdc.png
  Captured: 2026-09-14 21:24:10 UTC
  Source report: https://radar.cloudflare.com/scan/7a3981be-4daf-49ed-88d1-8e5f4ac5dfdc
  SHA-256: 690e2247c4e34771179eb0fd70f6e47e994b08b3098cab6da1133a86db4cee92
- URLScan · 2026-08-30: https://screenshots.phishdestroy.io/us/01a05321-53b4-716d-840a-d7a89876bbf3.png
  Captured: 2026-08-30 14:44:54 UTC
  Source report: https://urlscan.io/result/01a05321-53b4-716d-840a-d7a89876bbf3/
  SHA-256: 63c1f720075930f69713ccf6d1b7f49b854172ca6c027309c0bc8bde71fbaddb
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a1cf-ee71-776a-894b-be38899f39aa.png
  Captured: 2026-09-14 21:26:04 UTC
  Source report: https://urlscan.io/result/01a0a1cf-ee71-776a-894b-be38899f39aa/
  SHA-256: 395c40651f156a6bc0f2593482576b4013a34b9b034992583509bd7be189153e
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bf46-e528-7682-a87b-3995b343234b.png
  Captured: 2026-09-20 14:45:00 UTC
  Source report: https://urlscan.io/result/01a0bf46-e528-7682-a87b-3995b343234b/
  SHA-256: ecdeb24c0e49bff69cce74389aed2060711560c89c745374bf5281de35261f58
- URLScan · 2026-10-11: https://screenshots.phishdestroy.io/us/01a12b31-8307-77a8-80c1-cc69e727c3f2.png
  Captured: 2026-10-11 13:40:36 UTC
  Source report: https://urlscan.io/result/01a12b31-8307-77a8-80c1-cc69e727c3f2/
  SHA-256: 7c1dca7605d1e532f184a0a3b852c5973ad205ad27405f147bd23fe55375444a
- URLScan · 2026-10-13: https://screenshots.phishdestroy.io/us/01a134a2-bc2d-700b-9933-a63dd0abf82e.png
  Captured: 2026-10-13 09:40:53 UTC
  Source report: https://urlscan.io/result/01a134a2-bc2d-700b-9933-a63dd0abf82e/
  SHA-256: 597f55dbf0a7c3b611ff9bcf6c938989bbc1e0b93955e3032b846db1ed86cbdc

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:14:01Z",
        "uuid": "01a0a1cd-0a5f-7124-bdbf-d1f23fd9d3b3",
        "scanned_at": "2026-09-14T21:22:53Z",
        "final_url": "https://cl-service.is/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://cl-service.is/",
                "from": "http://cl-service.is/",
                "status": 307
            }
        ],
        "ip": "104.21.72.116",
        "domains": [
            "s3.eu-central-003.backblazeb2.com",
            "telegram.org",
            "static.cloudflareinsights.com"
        ],
        "ips": [
            "45.11.39.254",
            "149.154.167.99",
            "104.21.72.116"
        ],
        "asns": [
            "40401",
            "62041",
            "13335"
        ],
        "countries": [
            "NL"
        ],
        "link_domains": [
            "t.me"
        ],
        "social": [
            "https://t.me/VercettyVC4",
            "https://t.me/XoTabIch_011",
            "https://t.me/mega_service_admin"
        ],
        "doc_hash": "064a4efe92fd9eb2640647868b3ed15eff955268f57a03f6e4b2c8458aa779a4",
        "script_hashes": [
            "852a12c320b2fc9f8720c9bff8d9908a0013bceeaef5f9499da311057fcbd180",
            "06e456da3412e3215f14f8ab5ec351e9fceee5099c0ef03f11208b9c55676d24",
            "67b17a654999a7657ee674f0c33e1f159d519ba409f1bbe585e76bf996297327",
            "afd3c5c50951d598ad11dd2b82d431e2be48040a379061ad01a3fb778532ba22",
            "7e340c2de583d428a8807cec6d0b622e416c1d0f3be2f6b7cd199c561856cca6",
            "47be129fb29bd40c5e40eb7b8c6d4c4c08bba77d509b1bd4c092941911630d6b",
            "06c4e4ccd6c6b0e51d232906909a42a3e13524f02716a4024954d621edac8bae",
            "3bd9a452a97ff5f1cf79144ed813bf961f6a5c97827b4dfc4b8498955bdbf233",
            "fdc68e80151b83234de9ff094346b9964abfdba72c70db97b5180fe1bf1b2a78",
            "8aeee8d6782ff530d2668743699efb757dd8d5091ab49aab2120e894ab08ea68"
        ],
        "globals": [
            "Telegram",
            "TelegramGameProxy_receiveEvent",
            "TelegramGameProxy",
            "__reactRouterVersion",
            "MotionIsMounted",
            "proto",
            "TronWebProto",
            "QuillImageDropAndPaste"
        ],
        "storage_keys": [
            "__telegram__initParams"
        ],
        "tls": {
            "san": [
                "cl-service.is",
                "*.cl-service.is"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "cl-service.is",
            "protocol": "QUIC",
            "valid_to": "2026-10-22T14:51:02Z",
            "valid_from": "2026-07-24T13:56:08Z"
        },
        "domain_age_days": 52,
        "apex_age_days": 52,
        "tls_age_days": 52,
        "tls_valid_days": 90,
        "requests": 98,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 63,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "bancocontinental"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Banco Continental"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html",
            "content-security-policy": "default-src 'self'; script-src 'self' https://telegram.org https://challenges.cloudflare.com; script-src-attr 'none'; object-src 'none'; base-uri 'self'; frame-ancestors 'self' https://web.telegram.or",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:25:23Z",
        "uuid": "7a3981be-4daf-49ed-88d1-8e5f4ac5dfdc",
        "scanned_at": "2026-09-14T21:24:10Z",
        "final_url": "https://cl-service.is/",
        "status": 200,
        "history": [
            {
                "url": "https://cl-service.is/",
                "status": 200
            }
        ],
        "dom_hash": "01b7518b5b5c84d1855400151432daddce9e5cc75f732e560791880d0850d6e0",
        "doc_hash": "064a4efe92fd9eb2640647868b3ed15eff955268f57a03f6e4b2c8458aa779a4",
        "domain_risks": [
            "Vehicles"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "cl-service.is",
                "type": "A",
                "value": "104.21.72.116"
            },
            {
                "name": "cl-service.is",
                "type": "A",
                "value": "172.67.183.178"
            },
            {
                "name": "cl-service.is",
                "type": "AAAA",
                "value": "2606:4700:3030::ac43:b7b2"
            },
            {
                "name": "cl-service.is",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:4874"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.72.116",
        "whois": {
            "created": "2026-07-14T14:55:02Z",
            "updated": "2026-07-25T14:36:00Z",
            "nameservers": [
                "opal.ns.cloudflare.com",
                "rohin.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:54:56Z",
        "analysis_at": "2026-10-20T14:35:23Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 13,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Fortinet": "phishing",
            "SOCRadar": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "suspicious",
            "BitDefender": "phishing",
            "desenmascara.me": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "popularity": {
            "Cloudflare Radar": 1000000
        },
        "expires": "2027-07-14T00:00:00Z",
        "first_seen": "2026-07-24T16:05:13Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:10::ac42:a7db"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.20.32.77"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "opal.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.66.167.219"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "rohin.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "opal.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:10::6814:204d"
            }
        ],
        "dns_at": "2026-10-20T14:39:45Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "cl-service.is",
                "*.cl-service.is"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "bb93162436af095713dc17f0fd3aa39e",
            "sha256": "fa79220b9f66829dadfaee7afa5d8b9a5cd305a1e95f1eb5c5f88d33d75283b4",
            "subject": "cl-service.is",
            "valid_to": "2026-12-20T20:53:41Z",
            "valid_from": "2026-09-21T19:53:55Z"
        },
        "whois": {
            "dnssec": "unsigned delegation"
        },
        "rdap": {
            "status": [
                "active"
            ],
            "events": {
                "last changed": "2026-07-25T14:36:00Z",
                "registration": "2026-07-14T14:55:02Z",
                "soft expiration": "2027-07-14T14:52:15Z"
            }
        }
    }
}
```