Phishing page fqg.pap.temporary.site impersonates Bancolombia online banking
TheThreatWire flagged fqg.pap.temporary.site as a phishing page impersonating Bancolombia's Sucursal Virtual Personas login at /a/login.php. The domain is also on the Phishing Army blocklist.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 4 November 2026 TheThreatWire flagged www.fqg.pap.temporary.site as a phishing page impersonating Bancolombia, Colombia's largest bank, in its Alert #110, giving the login path /a/login.php. A screenshot attached to the post shows a page copying Bancolombia's Sucursal Virtual Personas personal online banking login. The Phishing Army community blocklist, checked by scammers.com on 4 November 2026, also lists fqg.pap.temporary.site.
How the scam works
The page is hosted on a free temporary.site subdomain with no connection to bancolombia.com. It copies the Sucursal Virtual login so that a customer who follows a link from an SMS, email or message enters their user name and password. Colombian banking phishing of this kind commonly follows with a request for the dynamic key or one-time code, which the criminals use to log in or approve a transaction while the victim is on the page.
With a Bancolombia login and a confirmation code, criminals can move money, add payees or enrol the account on a device they control. The use of a throwaway subdomain and a generic /a/login.php path is typical of kits that spin up many short-lived pages. Bancolombia advises customers to reach Sucursal Virtual only by typing bancolombia.com or using the official app, and never to enter keys or codes on a page reached from a link. Anyone who entered details should contact the bank immediately to block access, change the password and dynamic key, and review recent movements. The domain and path come from the alert and the blocklist and have not been independently checked by scammers.com.
Source
Post by @TheThreatWire on X, 4 November 2026 (2:13 AM ET), with a screenshot of the page. Not independently verified by scammers.com.
Red flags
- A Bancolombia login page on a free temporary.site subdomain.
- A generic login path such as /a/login.php.
- A request for your dynamic key or one-time code after the login.
- Links from SMS or email claiming a problem with your account.
- A domain that is not bancolombia.com.
If you were targeted
- 1Reach Sucursal Virtual only by typing bancolombia.com or using the official app.
- 2Do not enter your user name, password or dynamic key on a page reached from a link.
- 3If you entered details, call Bancolombia at once to block access and change your credentials.
- 4Review recent movements and any new payees.
- 5Report the link to Bancolombia.