anular-debito-bancolombia[.]iceiy[.]com

The domain anular-debito-bancolombia.iceiy.com is identified as a brand impersonation threat targeting Bancolombia, specifically mimicking its virtual branch login portal. Analysis confirms the domain is currently offline, though it previously hosted a fraudulent login page titled 'Sucursal Virtual Bancolombia — Iniciar sesión,' designed to harvest user credentials under false pretenses. Infrastructure analysis reveals the domain was created on December 6, 2020, and registered through Porkbun LLC. It resolves to the IP address 185.27.134.129, hosted on AS34119 (Wildcard UK Limited) in the United Kingdom. Security vendors flagged the domain in 18 out of 95 VirusTotal scans, and it appears on two security blocklists. The SSL certificate is issued by ZeroSSL, specifically under the 'ZeroSSL ECC Domain Secure Site CA' authority, which does not inherently validate legitimacy. Given its current offline status, the domain poses a reduced immediate threat, though historical activity warrants caution. Organizations and users are advised to block the domain and associated IP at perimeter defenses. Security teams should monitor for resurgence under similar naming conventions or infrastructure. If encountered, users should verify the legitimacy of Bancolombia portals exclusively through official channels and report suspicious domains to relevant threat intelligence platforms.