ABUSE NOTICE · 7D+ OPEN
Outgoing abuse reports are recorded; the latest stored availability evidence still shows the domain reachable.
Notification and current-status evidence
The sent-report ledger records the first outgoing report at .
The recorded recipient is trustandsafety@support.aws.com.
The latest stored availability evidence still shows the domain reachable; 26 days has elapsed since the first outgoing report.
ICANN RAA §3.18 describes registrar abuse-contact and handling obligations.
This section records outgoing timestamps, listed recipients, case identifiers, and later availability. It does not by itself prove receipt, acknowledgement, investigation, remediation, or contractual non-compliance.
virtual.labdigbdbstgpb.com is an impersonation phishing page that presents itself as "Banca Virtual Banco de Bogotá," the online banking portal of one of Colombia's largest banks. It targets the bank's retail and business customers who are led to believe they are signing in to their accounts. PhishDestroy first detected it on 2026-09-23, and it was still online on 2026-10-19.
How the scam works
The page copies the Banca Virtual login experience so that a visitor reaching it from an SMS, email or search ad sees what looks like the normal bank sign-in. Anything typed into the form goes to the operators instead of the bank. That typically includes the document number, username, password, and often one-time codes or token values requested on follow-up screens. With those details, criminals can log in to the real account in near real time, add payees and move money out. Some follow up with a call posing as the bank's fraud team.
Evidence
On 2026-10-03, 9 of 91 VirusTotal engines flagged the domain. The vendors flagging it include Kaspersky, Sophos, Forcepoint ThreatSeeker, alphaMountain.ai, Gridinsoft, Lionic, Seclookup and URLQuery. That is a minority of engines, but the detections come from several unrelated security companies, which supports the phishing verdict rather than pointing to a single false positive. The domain is also on the PhishDestroy blocklist.
Infrastructure
The parent domain was registered through Amazon Registrar, Inc. on 2022-01-07, more than four years before PhishDestroy flagged this subdomain. A registration that old can make a phishing host look more established to reputation filters than a freshly created one. The site resolves to 18.238.243.104 on Amazon.com, Inc. infrastructure in the Netherlands and uses an Amazon-issued TLS certificate. The padlock in the browser therefore says nothing about whether the page belongs to the bank.
What to do
If you entered credentials on this page, contact Banco de Bogotá immediately through the number on your card or the official app. Ask them to block online access and review recent transfers and newly added payees. Change your Banca Virtual password, and change it on any other site where you used the same one. Never share one-time codes or token values with anyone who calls claiming to be the bank. Defenders should block the domain at DNS and web proxies and search mail and SMS logs for links to it, especially messages sent to users with Colombian banking relationships.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeReachable but protectedreason: Captcha85% confidence
Attributionmechanism: Challengesource: Current Http Probe
Evidence layersAvailability: Reachable but protectedContent: UnknownDNS: ResolvedRegistration: Unknown
Latest HTTP observationReachable but protectedCaptchaChallenge85%2026-10-19 22:33:01 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-19 22:35:39 UTC
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 11 identified
A
Amazon Web Services
PaaS
Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality.
Oracle Infinity is a digital analytics platform for tracking, measuring, and optimizing the performance and visitor behavior of enterprise websites and mobile apps.
Hotjar is a suite of analytic tools to assist in the gathering of qualitative data, providing feedback through tools such as heatmaps, session recordings, and surveys.
Google Tag Manager is a tag management system (TMS) that allows you to quickly and easily update measurement codes and related code fragments collectively known as tags on your website or mobile app.
Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface.
Amazon CloudFront is a fast content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency, high transfer speeds.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
