Security engines reporting a detection: 12. Public blocklists reporting a match: 2. Exercise extreme caution — do not enter credentials or personal information.
SSL certificate is invalid or expired. Issuer: Let's Encrypt / R13
Evidence Summary
Critical
VirusTotal
12/89
OTX
23 community refs
URLScan
Stored capture
The domain grupo-banca.online poses a generic_phishing threat and is currently offline, it does not appear to impersonate a specific brand but rather uses a reCAPTCHA verification page to deceive users.
This domain was flagged by 5 of 95 VirusTotal vendors and is registered through OwnRegistrar, Inc., it resolves to the IP address 91.202.233.170 and was created on April 27, 2026, furthermore, it appears on 3 security blocklists and has been found in 1 threat intelligence pulse by AlienVault OTX, these indicators suggest a high level of risk associated with this domain.
The current status of grupo-banca.online is offline, however, users are still advised to exercise caution when encountering similar domains, PhishDestroy recommends verifying the authenticity of websites on their platform to ensure safety, and in the case of grupo-banca.online, users should be wary of providing any sensitive information as the domain has been associated with malicious activity, the use of a Let's Encrypt R13 SSL certificate does not guarantee the legitimacy of the website, and users should always prioritize caution when interacting with unfamiliar websites
Detection-evasion analysis
Cloaking and traffic-distribution check
Not observedNo cloaking was observed in the stored scan
Stored crawler-versus-browser observations for this host, plus a live fingerprint check for Keitaro-style traffic distribution systems.
Stored cloaking flag
Not observed
Cloaking score
0/6
Last cloaking scan
Scanner note:unavailable: raw=connection_error; http=0; via=http_proxy; error=SOCKSHTTPConnectionPool(host='grupo-banca.online', port=80): Max retries exceeded with url: / (Caused by NewConnectionEr
Live TDS fingerprint check
Seven Keitaro fingerprints plus a crawler-versus-browser comparison, run from the PhishDestroy scanner when this panel is open.
For this gTLD, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Accountability draft
Nothing is sent automatically.
Network & certificates
Stored technical evidence
Network & DNS
Resolved IP
91.202.233.170
Network ASN
AS200593
Organization
Prospero OOO
Observed location
Ashgabat, TM
Nameservers 1
c.dnspod.com
Location describes the IP network.
TLS certificate
Issuer
Let's Encrypt / R13
Valid from
2026-04-03 08:28:32
Valid until
2026-07-02 08:28:31
Hostname coverage
Certificate hostname mismatch
Validity
Stored certificate expired
Collection time
2026-04-27 08:00:06 UTC
Collection source
PhishDestroy collector
Certificate fingerprintfdfd65cb3eceb16b93327ead81bc9340d63b2ae1b16fa068f8b9d9ba0e86cc08Certificate names · 1 SANs
1ntutcentrec.com
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Latest HTTP observationUnknownProbe Inconclusive20%2026-10-11 10:09:30 UTC
RDAP registrationUnknown
Observed timelinelast reachable: 2026-09-15 22:17:58 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
Last analyzed Previous stored snapshot: 14 detections
alphaMountain.ai
BitDefender
Chong Lua Dao
CyRadar
Forcepoint ThreatSeeker
Fortinet
G-Data
Gridinsoft
Kaspersky
Lionic
Sophos
VIPRE
Threat Response Pipeline
Discovery
Analysis
Monitoring
9 recorded events. These records describe collected evidence, outgoing notifications and publication; they do not confirm a complete investigation or a takedown.
Threat Ingested
grupo-banca.online detected and queued for full analysis
We scan suspicious URLs, inspect public results and send evidence through the appropriate abuse-reporting channels. The dated events above show what is recorded for this domain. The directory below explains the wider workflow.
01Public scans & evidence collection10 sources and tool groups+
Inspect the public DNS, TLS, HTTP and technology surface.
02Abuse reports & follow-upRegistrar, hosting and security channels+
Identify the responsible provider. Match registration and hosting records to the relevant abuse contact.
Prepare an evidence package. Include the URL, public scan references, captures and the recorded observations.
Send the report. Keep outgoing report records and recipient information when available.
Recheck and publish updates. Track later scanner verdicts, provider responses and site availability.
Security services used for scanning, reputation checks and reporting are listed below. A service being listed is not evidence that it received, accepted or acted on this particular domain. Recorded submissions appear in the notification history above.
4 evidence signal groups linked0 reports recordedUnverified
If credentials were compromised, report immediately. Do not engage with recovery scammers.
If credentials, payment data, or files were exposed, report the incident immediately. Change affected passwords, revoke active sessions, and scan the device.
Beware of recovery scammers! Recovery scammers may pose as investigators, lawyers, or tracing services. Do not pay upfront fees or disclose credentials.Learn more about recovery fraud →
Template-based draft · optional AI wording assistance requires separate consent
Template-based draft • optional AI wording assistance requires separate consent · Review and submit it yourself
Related Infrastructure & Reports
Stored relationships are grouped by the exact matching attribute. A shared provider or registrar alone does not prove common ownership.
Direct link Shares a registration or an identical phishing kit.
Supporting signal Shares infrastructure or a target brand; not proof of one operator.
Discovery only Listed for navigation; no shared attribute with this host.
Infrastructure map · grupo-banca.online
Each lane is one reason a domain is linked to this host. Node size marks VirusTotal detections and dashed nodes are already offline. The full lists follow below.
Content matches4
Same favicon hash or the same page title as this host.
(US)
