Santander

Banking Spainsantander.comRank 43 of the most impersonated
Cert findings · 24 h
4
Cert findings · 7 days
24
1 reported or listed · 17 on phishing hosts · 6 on Spamhaus DROP
Registered lookalikes
216
34 listed by a source or an address list
Official domains
127
verified from Santander's own sites and records

Certificate findings for Santander

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Santander's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 33 findings, grouped by hostname

  1. santanderbank.cm NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 10 y ago
    DetailsHide
    Hostname
    santanderbank.cm
    First seen
    2026-11-05 09:04 UTC
    First published
    2026-10-28 05:36 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.7.194.67.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.7.194.67
    Brand
    Santander
    Addresses
    212.7.194.67 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    69.162.80.62 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    santanderbank.cm
    Registered
    2017-02-05 · Netcom.cm Sarl
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  2. bancosantander.ph NL · AS43350 · NFORCE NForce Entertainment…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    bancosantander.ph
    First seen
    2026-11-05 09:02 UTC
    First published
    2026-10-28 05:36 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.92.105.200.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.92.105.200
    Brand
    Santander
    Addresses
    212.92.105.200 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    212.92.105.199 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    Domain
    bancosantander.ph
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  3. santander.co.uk.vin US · AS20473 · The Constant Company, LLC
    Phishing hostVultrAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 20 mo ago
    DetailsHide
    Hostname
    santander.co.uk.vin
    First seen
    2026-11-04 20:45 UTC
    First published
    2026-11-04 21:09 UTC
    DNS
    Resolves · checked 2026-11-04 21:16 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 139.180.187.142.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 139.180.187.142
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 19:34 UTC to 2027-02-02 19:34 UTC
    Logged 2026-11-04 20:32 UTC in Let's Encrypt Willow2027h1, entry 938,078,377
    SHA-256 9367378cf56b25ec5dffa7bb817d72b3f5947ef83ea379cd063884f108f53c3a
    Public key SHA-256 6aa701a7ed61ef6559382c35f5e2f899624eb0c1de03d61f8c56456db04668c4
    Brand
    Santander
    Addresses
    139.180.187.142 · United States · AS20473 AS-VULTR - The Constant Company, LLC · Vultr (cloud provider)
    Vultr
    Vultr (139.180.187.142): a cloud provider. It rents servers and addresses to its customers.
    Domain
    uk.vin
    Registered
    2025-03-03 · NameCheap, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 21:09 UTC

    Suggest a correction

  4. santander.com.cn US · AS46844 · Sharktech2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    santander.com.cn
    First seen
    2026-11-04 13:55 UTC
    First published
    2026-10-31 13:42 UTC
    DNS
    Resolves · checked 2026-11-04 13:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 208.98.40.222.
    1. Phishing-host list fetched with the address
    2. Resolved to 208.98.40.222
    Brand
    Santander
    Addresses
    208.98.40.222 · United States · AS46844 SHARKTECH - Sharktech
    208.98.43.93 · United States · AS46844 SHARKTECH - Sharktech
    Domain
    santander.com.cn
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  5. www.santander-es.com FR · AS16276 · OVH OVH SAS
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 13 d ago
    DetailsHide
    Hostname
    www.santander-es.com
    First seen
    2026-11-04 08:58 UTC
    First published
    2026-11-04 09:19 UTC
    DNS
    Resolves · checked 2026-11-05 09:38 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.30.96.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.91.30.96
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 07:54 UTC to 2027-02-02 07:54 UTC
    Logged 2026-11-04 08:52 UTC in DigiCert Wyvern2027h1, entry 400,318,075
    SHA-256 164ef54257142fcdddeaa542c6da06852f24c1fb1e754b0f5af9e3e9cad88a45
    Public key SHA-256 f0b4af2de7748d7d50a881b111ae6861d9e44f0c4463ad40a7742f3c45596e81
    Brand
    Santander
    Addresses
    51.91.30.96 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.91.30.96): a cloud provider. It rents servers and addresses to its customers.
    Domain
    santander-es.com
    Registered
    2026-10-23 · Tucows Domains Inc.
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:10 UTC

    Suggest a correction

  6. santander-es.com FR · AS16276 · OVH OVH SAS
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missingRegistered 13 d ago
    DetailsHide
    Hostname
    santander-es.com
    First seen
    2026-11-04 08:58 UTC
    First published
    2026-11-04 09:19 UTC
    DNS
    Resolves · checked 2026-11-05 09:38 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.91.30.96.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.91.30.96
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 07:54 UTC to 2027-02-02 07:54 UTC
    Logged 2026-11-04 08:52 UTC in DigiCert Wyvern2027h1, entry 400,318,075
    SHA-256 164ef54257142fcdddeaa542c6da06852f24c1fb1e754b0f5af9e3e9cad88a45
    Public key SHA-256 f0b4af2de7748d7d50a881b111ae6861d9e44f0c4463ad40a7742f3c45596e81
    Brand
    Santander
    Addresses
    51.91.30.96 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.91.30.96): a cloud provider. It rents servers and addresses to its customers.
    Domain
    santander-es.com
    Registered
    2026-10-23 · Tucows Domains Inc.
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 09:10 UTC

    Suggest a correction

  7. www.santander-festgeld.de SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    www.santander-festgeld.de
    First seen
    2026-11-03 12:50 UTC
    First published
    2026-11-03 13:19 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-03 11:46 UTC to 2027-02-01 11:46 UTC
    Logged 2026-11-03 12:45 UTC in Google ParcelYard2027h1, entry 590,391,992
    SHA-256 b7ab3aad390b116e27c0d2c8fef658b33a7ae4a3afa872b66125084613ea3740
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Santander
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    santander-festgeld.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  8. santander-festgeld.de SG · AS63949 · Akamai Connected Cloud3 addresses
    Phishing hostAkamai LinodeAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
    DetailsHide
    Hostname
    santander-festgeld.de
    First seen
    2026-11-03 10:47 UTC
    First published
    2026-11-03 11:04 UTC
    DNS
    Resolves · checked 2026-11-04 11:13 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.232.24.161.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.232.24.161
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-03 09:46 UTC to 2027-02-01 09:46 UTC
    Logged 2026-11-03 10:44 UTC in DigiCert Wyvern2027h1, entry 387,261,614
    SHA-256 557d879ce5026043cff0966e869eb69af36a5947ea2e782249abb12f4ef2a5c7
    Public key SHA-256 9c0d3cae4928bd8bad20b19f0040371e902bb6f7825ecdd301bfef5b7e864f57
    Brand
    Santander
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Domain
    santander-festgeld.de
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  9. secure-dev.santander-portugal.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…
    ReportedParking page · ParkingCrew (Team Internet)Under santander-portugal.com, reported by PhishDestroyMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    secure-dev.santander-portugal.com
    First seen
    2026-11-03 07:15 UTC
    First published
    2026-11-03 07:43 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 07:49 UTC
    Reported
    PhishDestroy, listing santander-portugal.com and the names under it
    1. Observed in the PhishDestroy feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-11-03 06:12 UTC to 2027-02-01 06:12 UTC
    Logged 2026-11-03 07:10 UTC in IPng Networks Gouda2027h1, entry 299,957,685
    SHA-256 c596965b13d42d68cb2869f2d69f327c0046a4fc23b62a0a1886216788857121
    Public key SHA-256 b48610893723c5dfe4abbc00f769c56c479098734ee68a0f058db693376d422d
    PhishDestroy
    Brand
    Santander
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Domain
    santander-portugal.com
    Registered
    2026-07-01 · Hosting Concepts B.V. d/b/a Registrar.eu
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:36 UTC

    Suggest a correction

  10. www.santander.com.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 y ago
    DetailsHide
    Hostname
    www.santander.com.pl
    First seen
    2026-11-02 13:58 UTC
    First published
    2026-11-02 14:21 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 12:55 UTC to 2027-01-31 12:55 UTC
    Logged 2026-11-02 13:53 UTC in Let's Encrypt Sycamore2027h1, entry 904,718,497
    SHA-256 85e8c2ec9f8aa11c53d545ce66fe64264e387c71171d8520cd6cc2a8a3f6ed50
    Public key SHA-256 a5a073e0e900f18e8bb93349917ed11689f1e13352965b5687abd5faf22f1d0b
    Brand
    Santander
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    santander.com.pl
    Registered
    2024-03-23 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  11. santander.com.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 3 y ago
    DetailsHide
    Hostname
    santander.com.pl
    First seen
    2026-11-02 13:57 UTC
    First published
    2026-11-02 14:21 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 12:55 UTC to 2027-01-31 12:55 UTC
    Logged 2026-11-02 13:53 UTC in Let's Encrypt Sycamore2027h1, entry 904,718,497
    SHA-256 85e8c2ec9f8aa11c53d545ce66fe64264e387c71171d8520cd6cc2a8a3f6ed50
    Public key SHA-256 a5a073e0e900f18e8bb93349917ed11689f1e13352965b5687abd5faf22f1d0b
    Brand
    Santander
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    santander.com.pl
    Registered
    2024-03-23 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  12. mail.santander-info.com.mx GB · AS204800 · WHG-SGP WHG Hosting Service…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC quarantine
    DetailsHide
    Hostname
    mail.santander-info.com.mx
    First seen
    2026-10-31 10:36 UTC
    First published
    2026-10-31 11:03 UTC
    DNS
    Resolves · checked 2026-11-04 11:10 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.138.189.72.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 103.138.189.72
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-31 09:33 UTC to 2027-01-29 09:33 UTC
    Logged 2026-10-31 10:32 UTC in Google ParcelYard2027h1, entry 537,429,017
    SHA-256 207308b43527278a00970d83c9d3f9e3eafaf8d7d365433772064e0c1bf28555
    Public key SHA-256 e3dc156aa43d0fc9b19a860d9c52c59de1fce3e7f5fd49a314b397aca0fe8d65
    Brand
    Santander
    Addresses
    103.138.189.72 · United Kingdom · AS204800 WHG-SGP WHG Hosting Services Ltd
    Domain
    santander-info.com.mx
    MX
    Receives mail at mail.santander-info.com.mx
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  13. m.supportsantanderconnect.com PA · AS51852 · PLI-AS Private Layer INC
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 24 d ago
    DetailsHide
    Hostname
    m.supportsantanderconnect.com
    First seen
    2026-10-29 20:26 UTC
    First published
    2026-10-29 20:34 UTC
    DNS
    Checked · checked 2026-11-04 20:44 UTC
    Checks
    Overdue since 2026-10-30 20:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 179.43.175.13.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 179.43.175.13
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 179.43.175.13.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 179.43.175.13
    Certificate
    Issued by YE1
    Valid 2026-10-29 19:26 UTC to 2027-01-27 19:25 UTC
    Logged 2026-10-29 20:24 UTC in Google PlumbersArms2027h1, entry 512,064,650
    SHA-256 9a717a161befce1c7a5967a058dc65b54c786828641ad085974b1e1f0729cf56
    Public key SHA-256 813c619b9f5bf28cfd0ca794568cff46bcf3f6ae7d5b42828028aca571a4a8d5
    Brand
    Santander
    Addresses
    179.43.175.13 · Panama · AS51852 PLI-AS Private Layer INC
    Domain
    supportsantanderconnect.com
    Registered
    2026-10-12 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-10-29 18:29 UTC

    Suggest a correction

  14. www.supportsantanderconnect.com PA · AS51852 · PLI-AS Private Layer INC
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 24 d ago
    DetailsHide
    Hostname
    www.supportsantanderconnect.com
    First seen
    2026-10-29 18:21 UTC
    First published
    2026-10-29 18:29 UTC
    DNS
    Checked · checked 2026-11-04 18:34 UTC
    Checks
    Overdue since 2026-10-30 18:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 179.43.175.13.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 179.43.175.13
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 179.43.175.13.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 179.43.175.13
    Certificate
    Issued by YE1
    Valid 2026-10-29 17:21 UTC to 2027-01-27 17:21 UTC
    Logged 2026-10-29 18:19 UTC in Google ParcelYard2027h1, entry 510,023,382
    SHA-256 4e4dcf1f2a2340dd6911c231104b6ce83fe097e3c39e07425e043a71697985ea
    Public key SHA-256 12124ce9ac9a433a082b05f3649e7945d52d3bab2c0f7cf5ae8ff0dafe76e01c
    Brand
    Santander
    Addresses
    179.43.175.13 · Panama · AS51852 PLI-AS Private Layer INC
    Domain
    supportsantanderconnect.com
    Registered
    2026-10-12 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-10-29 18:29 UTC

    Suggest a correction

  15. www.santanderconnect-portal.com PA · AS51852 · PLI-AS Private Layer INC
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    www.santanderconnect-portal.com
    First seen
    2026-10-29 18:21 UTC
    First published
    2026-10-29 18:29 UTC
    DNS
    Checked · checked 2026-11-04 18:34 UTC
    Checks
    Overdue since 2026-10-30 18:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 179.43.175.13.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 179.43.175.13
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 179.43.175.13.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 179.43.175.13
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-29 17:21 UTC to 2027-01-27 17:21 UTC
    Logged 2026-10-29 18:19 UTC in Let's Encrypt Willow2027h1, entry 836,862,783
    SHA-256 9421736a6f9359d0213e6d11ff46a299ed6b2e3da690b028da1f2a2d24315525
    Public key SHA-256 99e0c6dd1e09878a5ad37e545831eb3a9e9c62f31b593c2661def1a478ff7976
    Brand
    Santander
    Addresses
    179.43.175.13 · Panama · AS51852 PLI-AS Private Layer INC
    Domain
    santanderconnect-portal.com
    Registered
    2026-10-29 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-10-29 18:29 UTC

    Suggest a correction

  16. supportsantanderconnect.com PA · AS51852 · PLI-AS Private Layer INC
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 24 d ago
    DetailsHide
    Hostname
    supportsantanderconnect.com
    First seen
    2026-10-29 18:21 UTC
    First published
    2026-10-29 18:29 UTC
    DNS
    Checked · checked 2026-11-04 18:34 UTC
    Checks
    Overdue since 2026-10-30 18:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 179.43.175.13.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 179.43.175.13
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 179.43.175.13.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 179.43.175.13
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 17:21 UTC to 2027-01-27 17:21 UTC
    Logged 2026-10-29 18:19 UTC in Let's Encrypt Willow2027h1, entry 836,862,650
    SHA-256 4a43749f354db3ad4233a78e006cd0e658c3a3907571a4834e5fa39cb16434d2
    Public key SHA-256 7cdc089a61a5169ea3965be13d21c2e43d0c8d93c9f7f55fee86661035bdc142
    Brand
    Santander
    Addresses
    179.43.175.13 · Panama · AS51852 PLI-AS Private Layer INC
    Domain
    supportsantanderconnect.com
    Registered
    2026-10-12 · OwnRegistrar, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-10-29 18:29 UTC

    Suggest a correction

  17. santanderconnect-portal.com PA · AS51852 · PLI-AS Private Layer INC
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    santanderconnect-portal.com
    First seen
    2026-10-29 18:21 UTC
    First published
    2026-10-29 18:29 UTC
    DNS
    Checked · checked 2026-11-04 18:34 UTC
    Checks
    Overdue since 2026-10-30 18:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 179.43.175.13.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 179.43.175.13
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 179.43.175.13.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 179.43.175.13
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-29 17:21 UTC to 2027-01-27 17:21 UTC
    Logged 2026-10-29 18:19 UTC in Let's Encrypt Sycamore2027h1, entry 842,886,629
    SHA-256 a57cf6a58c5428941307f37443a77e6f225f038568a3a6b21fa9d2e54da96253
    Public key SHA-256 84f154aef438ada3554d45a41f1d7f5c01208128906d43a5f80199c5c42d4a12
    Brand
    Santander
    Addresses
    179.43.175.13 · Panama · AS51852 PLI-AS Private Layer INC
    Domain
    santanderconnect-portal.com
    Registered
    2026-10-29 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-10-29 18:29 UTC

    Suggest a correction

  18. mta-sts.santanderconnect-portal.com PA · AS51852 · PLI-AS Private Layer INC
    Phishing hostSpamhaus DROPAddress hosted confirmed phishing in the last 48 h · Address listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    mta-sts.santanderconnect-portal.com
    First seen
    2026-10-29 18:21 UTC
    First published
    2026-10-29 18:29 UTC
    DNS
    Checked · checked 2026-11-04 18:34 UTC
    Checks
    Overdue since 2026-10-30 18:31 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 179.43.175.13.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 179.43.175.13
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 179.43.175.13.
    1. Spamhaus DROP list fetched with the address
    2. Resolved to 179.43.175.13
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-29 17:21 UTC to 2027-01-27 17:21 UTC
    Logged 2026-10-29 18:19 UTC in Let's Encrypt Sycamore2027h1, entry 842,887,776
    SHA-256 99a4c72403dd8c0452e6cd2deb14270b7a6e0b21f790656bad501b934714a3a2
    Public key SHA-256 7a3e0fdeca9bd6ed54c9585917d3b145a841c1887e15e05267b115c3ae4bf4c8
    Brand
    Santander
    Addresses
    179.43.175.13 · Panama · AS51852 PLI-AS Private Layer INC
    Domain
    santanderconnect-portal.com
    Registered
    2026-10-29 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-10-29 18:29 UTC

    Suggest a correction

  19. www.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    www.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  20. webmail.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    webmail.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  21. staging.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    staging.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  22. smtp.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    smtp.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  23. pop.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    pop.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  24. mail.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    mail.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  25. jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  26. imap.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    imap.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

  27. ftp.jameel-santander.it IT · AS47242 · HOST-SPA Host SpA
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    ftp.jameel-santander.it
    First seen
    2026-10-29 09:52 UTC
    First published
    2026-10-29 10:53 UTC
    DNS
    Resolves · checked 2026-11-04 11:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 149.62.187.89.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 149.62.187.89
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 08:51 UTC to 2027-01-27 08:51 UTC
    Logged 2026-10-29 09:49 UTC in IPng Networks Gouda2027h1, entry 258,113,672
    SHA-256 8b55612c14c501f1d5ad67c0f170fd9a07821b07b603fa74dbbb7b5ad11c183e
    Public key SHA-256 a0e9ef5aab5ab09a697db4948da68d53cc359505880a1c07a95ecbbc78c5efdc
    Brand
    Santander
    Addresses
    149.62.187.89 · Italy · AS47242 HOST-SPA Host SpA
    Domain
    jameel-santander.it
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 19:26 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Santander when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Banking

All brands →