temporada--solcitudmovil[.]replit[.]app

This domain is a credential harvesting phishing site impersonating Banco BHD León (BHD), a financial institution. The site displays a fraudulent login interface labeled 'BHD - IBP' to trick users into entering banking credentials, which are then captured by threat actors for unauthorized account access or financial fraud. The attack targets customers of BHD Bank, exploiting trust in the legitimate banking portal to facilitate credential theft and subsequent fraudulent transactions. Analysis indicates the domain was registered on February 22, 2026, through Nom-IQ Limited dba Com Laude, an unusual registrar choice for phishing domains. Infrastructure analysis reveals the site resolves to 34.117.33.233 (AS396982, Google LLC) and uses an SSL certificate issued by Google Trust Services (WR3). The domain appears on one security blocklist and is flagged by 20 out of 95 security vendors on VirusTotal, confirming its malicious classification. The combination of recent registration, hosting on cloud infrastructure, and high detection rate by security engines underscores its elevated risk level. Users who visited temporada--solcitudmovil.replit.app should immediately take corrective action. First, reset all credentials entered on the site, prioritizing banking and email accounts. Second, enable multi-factor authentication on all critical accounts to prevent unauthorized access. Third, monitor financial statements for unauthorized transactions and report suspicious activity to the bank. If personal or financial data was exposed, consider placing a fraud alert with credit bureaus. The domain has been taken offline, but users should remain vigilant for follow-up phishing attempts via email or SMS.