bancolombia-creditovirtual-co[.]netlify[.]app

This domain, bancolombia-creditovirtual-co.netlify.app, is actively impersonating Bancolombia’s virtual credit services to harvest user credentials. Analysis indicates the site presents a fraudulent login interface mimicking the bank’s official portal, designed to capture account numbers, passwords, and one-time authentication codes. The threat specifically targets customers accessing credit services, increasing the likelihood of financial fraud or unauthorized transactions if credentials are entered. Infrastructure analysis reveals the domain is hosted on Netlify’s platform and resolves to IP address 35.157.26.135, located in Germany under Amazon.com, Inc.’s AS16509. As of the latest scan, 15 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on one security blocklist and is currently classified as active. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), does not mitigate the risk, as phishing sites frequently use valid certificates to appear legitimate. Users who have visited bancolombia-creditovirtual-co.netlify.app or entered credentials on the site should immediately revoke active sessions and change passwords for their Bancolombia accounts. Enable multi-factor authentication if not already active. Monitor bank statements for unauthorized transactions and report any suspicious activity to the financial institution. Clear browser cache and cookies to remove any stored session data. If personal or financial information was submitted, consider placing a fraud alert with credit bureaus and reviewing credit reports for signs of identity theft.