mail[.]fqm[.]nyx[.]temporary[.]site

This domain, mail.fqm.nyx.temporary.site, is actively serving a brand‑impersonation campaign targeting Bancolombia. The site presents the page title “Servicios | Bancolombia” and issues an HTTP 302 redirect. Infrastructure analysis shows the domain resolves to 50.6.2.252, an IP hosted in the United States and announced by AS31898 (Oracle Corporation). Registration data indicates the domain was created on 4 August 2023 through ENOM, INC., and uses the authoritative name servers ns1.temporary.site and ns2.temporary.site. The TLS certificate is signed by Sectigo Limited under the Sectigo Public Server Authentication CA DV R36, confirming the use of a publicly trusted SSL chain. Reputation signals are strongly negative: the domain is listed on two security blocklists, is blocked by PhishDestroy and PhishingDB, carries a Gridinsoft trust score of 0 / 100, and 15 of 95 VirusTotal scanners have flagged it. The risk rating is high and the campaign remains active. While the exact page content has not been inspected, the observable metadata confirms a targeted impersonation of Bancolombia. Defenders should immediately block the domain and its resolver IP at network perimeters, add the host to internal threat intel feeds, and monitor for any related C2 or credential‑harvesting activity. Continued observation of the certificate and name‑server changes is recommended to detect potential infrastructure shifts.