mipersonascancelaseguro[.]com

Analysis of mipersonascancelaseguro.com indicates a high‑confidence brand‑impersonation campaign targeting Bancolombia customers. The domain was registered on December 26, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to IP address 143.244.212.87, which is hosted by DigitalOcean, LLC (AS14061) in the United States. No TLS certificate is presented, meaning the site is served over plain HTTP, a common characteristic of fraudulent pages. The page title returned by the server is "Bancolombia Sucursal Virtual Personas," directly referencing the targeted financial institution, confirming the impersonation intent.

Infrastructure signals show the domain is listed on a single security blocklist and has been flagged by 18 of 93 VirusTotal scanners, reinforcing the malicious classification. AlienVault OTX reports the domain in one threat‑intelligence pulse, and Gridinsoft assigns a trust score of 0 out of 100, indicating extreme untrustworthiness. The domain is currently offline, and PhishDestroy has taken it down, but historical evidence suggests it was used to lure victims into providing credentials. Nameservers are lovisa.ns.cloudflare.com and quincy.ns.cloudflare.com, both Cloudflare‑managed, a pattern frequently observed in phishing infrastructure.

Defenders should continue to block the domain at perimeter firewalls, update URL filtering lists, and monitor for any resurgence of the same IP or nameserver pairings. Incident responders should treat any emails or messages referencing the Bancolombia virtual branch as suspicious, and users should be warned that the domain is not a legitimate Bancolombia service. Ongoing threat‑intel feeds should be consulted for potential re‑use of the hosting assets.