zmn[.]djb[.]temporary[.]site

This domain, zmn.djb.temporary.site, poses a targeted brand impersonation threat against Bancolombia, a major financial institution. Analysis indicates the infrastructure was designed to deceive users into believing they are interacting with legitimate Bancolombia services, likely to harvest login credentials, personal identification details, or financial transaction data. The page title, 'Servicios | Bancolombia,' directly mimics the bank’s official branding, increasing the likelihood of successful social engineering attacks against customers. Infrastructure analysis reveals the domain was registered on August 04, 2023, through ENOM, INC., and resolves to the IP address 50.6.2.252, hosted under AS31898 (Oracle Corporation) in the United States. The domain appears on two security blocklists and is flagged by 16 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. The SSL certificate, issued by Sectigo Limited under the 'Sectigo Public Server Authentication CA DV R36' intermediate, was likely acquired to lend an appearance of legitimacy, though it does not mitigate the underlying threat. Users who visited zmn.djb.temporary.site or entered credentials on this domain should immediately revoke any active sessions with Bancolombia’s legitimate services and reset their account passwords. Multi-factor authentication (MFA) tokens or recovery codes associated with the account should also be regenerated. Financial institutions should be notified to monitor for unauthorized transactions. Network administrators are advised to block the domain and its resolving IP (50.6.2.252) at the perimeter to prevent further exposure. Historical logs should be reviewed for connections to this domain or IP to assess potential compromise.