bancolombia-creditovirtual-co-com[.]netlify[.]app

This domain, bancolombia-creditovirtual-co-com.netlify.app, is currently flagged as an active credential phishing site specifically impersonating Bancolombia, a major financial institution. The threat type is classified as generic phishing with a focus on harvesting user login credentials, financial details, and personal identification information. As of the latest assessment, the domain remains operational and poses a high risk to unsuspecting users. Infrastructure analysis reveals the domain is registered through Netlify and resolves to the IP address 35.157.26.135, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) located in Germany. The SSL certificate is issued by DigiCert Inc under the DigiCert Global G2 TLS RSA SHA256 2020 CA1 chain, which, while legitimate, is commonly exploited by threat actors to lend false credibility. The domain has been flagged by 11 of 95 security vendors on VirusTotal, appears on two distinct security blocklists, and is actively blocked by at least two major threat intelligence feeds. No legitimate association with Bancolombia or its official services has been verified. The current status of this domain remains active, with no indications of takedown or mitigation at this time. Users are strongly advised to avoid interacting with this domain or any subdomains associated with it. Financial institutions and security teams should immediately update their blocklists to include this domain and its resolving IP address. End-users who may have entered credentials on this site should reset their passwords, enable multi-factor authentication, and monitor their accounts for unauthorized activity. Organizations are encouraged to conduct internal awareness campaigns to educate employees and customers about the risks of credential phishing targeting financial services.