tdk[.]xjw[.]temporary[.]site

This domain, tdk.xjw.temporary.site, poses a significant threat as a brand impersonation site targeting Bancolombia. The domain was used to create a phishing page designed to mimic the official Bancolombia website, potentially leading users to inadvertently provide sensitive information such as login credentials and personal data.

Analysis indicates that tdk.xjw.temporary.site was flagged by 17 out of 95 security vendors on VirusTotal, suggesting a notable level of suspicion among the cybersecurity community. The domain was registered through ENOM, INC. on August 04, 2023, and resolves to the IP address 50.6.108.182, which is located in the United States and is part of the AS31898 Oracle Corporation network. The site appears on two security blocklists, PhishDestroy and PhishingDB, further confirming its malicious nature. The SSL certificate is issued by Sectigo Limited, which is commonly used by legitimate websites but can also be obtained by threat actors to add a layer of credibility to their phishing operations.

If users have visited tdk.xjw.temporary.site, they should immediately check their Bancolombia accounts for any unauthorized activity. Users are advised to change their passwords and enable multi-factor authentication (MFA) for additional security. It is also recommended to monitor credit reports and bank statements for any signs of fraud. Reporting the incident to Bancolombia's customer support and to relevant cybersecurity authorities can help mitigate potential damage and prevent further incidents.