ingresa-grup-aval[.]vercel[.]app

The domain ingresa-grup-aval.vercel.app has been confirmed as a credential harvesting phishing site. Analysis indicates this infrastructure was designed to impersonate Grupo Aval, a major financial services provider, with the intent of harvesting user login credentials. The domain is currently offline, though prior activity suggests it was actively targeting customers of the financial institution through deceptive login portals. Infrastructure analysis reveals the domain was flagged by 17 of 95 security vendors on VirusTotal, with additional detections on two independent blocklists. The domain was registered through Tucows Domains Inc. and resolved to the IP address 64.29.17.67, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509). The SSL certificate was issued by Google Trust Services under the WR1 intermediate. Domain records indicate creation on February 21, 2026, suggesting recent deployment for malicious purposes. The page title 'Deployment Unavailable' appears to be a placeholder or error state, potentially masking the active phishing interface during operational periods. Current status shows the domain has been taken offline, though residual risk remains for users who may have interacted with the site during its active window. Security teams are advised to monitor for credential reuse attempts and implement additional authentication controls for potentially compromised accounts. Network administrators should update blocklists to include the domain and associated IP address, while end users should be alerted to verify domain authenticity before entering financial credentials. Continuous monitoring of similar subdomain patterns on legitimate hosting platforms is recommended to detect emerging threats.