ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is abuse@ionos.com.
The latest stored availability evidence still shows the domain reachable; 20 days has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations.
This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
gc.bnjazi.com is an impersonation phishing page posing as Banco de Venezuela. It targets the bank's customers with a Spanish-language portal titled "Acceso al Sistema - Trámites y Solicitudes" (System Access - Procedures and Requests). PhishDestroy first detected it on 2026-09-29. On 2026-10-19 the site was still reported alive, but its DNS was inactive, so it may resolve only intermittently or may be in the process of going offline.
How the scam works
The page title presents the site as an official gateway for handling bank paperwork and service requests. Lures like this usually reach victims through SMS, WhatsApp or social media messages that claim an account needs updating, a request is pending, or access will be suspended. The victim is asked to sign in, and whatever they type goes to the operators: usernames, passwords, card details, and often the one-time codes the bank sends by SMS. With those, attackers can log in to the real account and move money before the customer notices.
Evidence
On 2026-10-01, 11 of 91 VirusTotal engines flagged the site, including BitDefender, CRDF, ESET, Emsisoft, Fortinet, G-Data, Gridinsoft and MalwareURL. That is a modest share of engines, but the vendors come from independent sources. urlscan.io returned a malicious verdict and specifically recognised Banco de Venezuela branding on the page. Spamhaus lists the domain in its DBL as spam, and it is on the PhishDestroy blocklist.
Infrastructure
The parent domain, bnjazi.com, was registered through IONOS SE on 2026-06-25, about three months before PhishDestroy caught the phishing subdomain. That gap suggests the domain was set up ahead of time and the subdomain was added later for this campaign. The page is hosted on Oracle Corporation's cloud network in the United States, far from the Venezuelan customers it targets. It uses a free Let's Encrypt certificate, so the padlock in the browser says nothing about whether the site is legitimate.
What to do
If you entered your Banco de Venezuela credentials on this page, change your password right away through the bank's official app or website, not through any link you were sent. Then call the bank to report the incident and ask about blocking cards or transfers. Review recent transactions, and treat any unexpected code or call claiming to be from the bank as part of the attack. Security teams should block both bnjazi.com and its subdomains as well as the hosting IP, and report the abuse to IONOS SE and Oracle so the site comes down for good.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeDNS 非アクティブreason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation不明Probe Inconclusive20%2026-10-20 10:06:46 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-13 01:43:19 UTClast content: 2026-10-13 01:43:19 UTCcurrent episode first observed: 2026-10-13 20:21:07 UTCobserved RIP window: 2026-10-13 01:43:19 UTC → 2026-10-13 20:21:07 UTC · 18.63hmidpoint estimate ≈ 2026-10-13 11:02:13 UTC · precision medium · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 2 identified
A
Apache HTTP Server
Web servers
Apache is a free and open-source cross-platform web server software.
PDF notice generated Notice text archived (594 chars)
Abuse notice text as sent to the provider
Policy Violations:
Illegal Activities: Active phishing operation targeting victims
Fraud & Deception: Impersonation of legitimate services
Identity Theft: Collection of credentials under false pretenses
Applicable Laws (DE):
German Criminal Code § 263 (Fraud)
German Criminal Code § 263a (Computer Fraud)
Telemedia Act (TMG)
German law prohibits fraud and computer-based deception.
Action Required: This evidence-backed report demonstrates clear violations requiring suspension per your policies. Continued hosting exposes your organization to regulatory scrutiny and potential legal liability.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(DE)
