Phishing sites impersonating Santander

PhishDestroy has recorded 60 phishing domains impersonating Santander since 2025-08-16, 2 of them in the last 30 days. The most used registrars are DYNADOT and Cloudflare; the most common TLDs are .com and .app. Open Santander only from its official app or a saved bookmark.

60
Domains, all time
2
Last 30 days
31
Online at last check
7
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 12026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 12026-08-01: 12026-08-02: 12026-08-03: 02026-08-04: 02026-08-05: 12026-08-06: 12026-08-07: 02026-08-08: 12026-08-09: 02026-08-10: 12026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 12026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 22026-08-24: 22026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 02026-09-12: 02026-09-13: 02026-09-14: 12026-09-15: 02026-09-16: 02026-09-17: 12026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 02026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 12026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 12026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Santander phishing domains detected per day: 17 from 2026-07-25 to 2026-10-22; peak 2.

How to tell a fake Santander site

Words most often added to the brand in reported domains: santandermx, san, dothome, hosted, portal, mybluehost, sander, aul, staticfile, wasmer.

  • Type the address yourself or use a bookmark; phishing links for Santander arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Santander does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Santander phishing domains

The 50 most recently detected domains impersonating Santander
DomainFirst detectedStatus at last checkRegistrar
santander-newbusiness.es2026-10-13Online—
santander-gt.com2026-09-26OnlineNOMINALIA INTERNET S.L
santander-remaster-whats-fb.vercel.app2026-09-17OnlineVercel
php-web-server--militarymandril.replit.app2026-09-14OnlineReplit
observatoriologisticodesantander.com2026-08-24OnlineGoDaddy.com
santander-invest.org2026-08-24OfflineDYNADOT
bancosantander-es.muttinfo.com2026-08-23OfflineWild West Domains
comercialbancosantanderconsigorg.org2026-08-23OnlineSquarespace Domains II
santander.pt-atendimento.com2026-08-14OfflineOwnRegistrar
santanderinvest.com2026-08-10OnlineCosmotown
websantander1.dothome.co.kr2026-08-08OnlineInames , (http://www.inames.kr)
santandermx.github.io2026-08-06OfflineGitHub
santanderweb.dothome.co.kr2026-08-05OnlineInames , (http://www.inames.kr)
santandermx.dothome.co.kr2026-08-02OnlineInames , (http://www.inames.kr)
satander2026.netlify.app2026-08-01OfflineNetlify
santander-protocolo.com2026-07-31OnlineRegistrar.eu
staticfile-sntandre.wasmer.app2026-07-25OfflineWasmer
ecokidsarttw.com2026-07-23OfflineNetwork Solutions
creditos-2026mx.webcindario.com2026-07-23OfflineTUCOWS.COM
sankaterd.click2026-07-19OfflineDynadot
402d8b54-a79e-4025-8d53-334b3607fbd1.clouding.host2026-07-17OfflineMarkMonitor
maxicre-aul-apl-san.azurewebsites.net2026-07-07OfflineMicrosoft Azure
staticfile-878b7.wasmer.app2026-07-07UnknownWasmer
acceso-sander-app-website.azurewebsites.net2026-07-07OfflineMicrosoft Azure
sander-aul-crediapp.azurewebsites.net2026-07-07OfflineMicrosoft Azure
highmarket.my2026-07-06OnlineDYNADOT
santaner.sbs2026-07-03OfflineDYNADOT
santander-portugal.com2026-07-02OnlineRegistrar.eu
pt-multibanco.com2026-06-26UnknownNICENIC
plearnthaipalace.com2026-06-23OnlineTUCOWS.COM
santandercycling.com.co2026-06-21OnlineCloudflare
minabus.cl2026-06-19OnlineNIC Chile
santunion.club2026-06-16OnlineDYNADOT
pensilvania.club2026-06-16OfflineDYNADOT
sanderunion.club2026-06-15OnlineDynadot
santanderbank.com.cobblestonesw.com2026-06-07OnlineCloudflare
santanderaumenta.pages.dev2026-05-07Taken downCloudflare
contribuinte-fazendapr2026.com2026-05-05Taken downPublicDomainRegistry.com
santander-vilkas.pages.dev2026-04-21Taken downCloudflare
link.hiper-ofertas.com2026-04-10OnlineGoDaddy.com
nhh.khd.mybluehost.me2026-04-06OnlineDomain.com
ggg.ixo.mybluehost.me2026-03-31OnlineDomain.com
seguroseguroautosoap.sbs2026-03-19OfflineNameSilo
galleta.jdevcloud.com2026-03-14Offline—
santstest.live2026-03-14OfflineName.com
policy-portal.dev.san.kpmgcdd-fincrime.com2026-03-11OnlineAmazon Registrar
san-mobile.xyz2026-02-26Offline—
santander-connectchat.com2026-02-26OfflineCNOBIN INFORMATION TECHNOLOGY
particularessantander.kinsta.cloud2026-02-26OfflineMarkMonitor
santanderbamk.co2026-02-19OfflineWeb Commerce Communications

All 60 Santander reports

Where they are registered and hosted

Registrars

  1. DYNADOT5
  2. Cloudflare4
  3. Microsoft Azure3
  4. Inames , (http://www.inames.kr)3
  5. Tucows Domains2
  6. Domain.com2
  7. GoDaddy.com2
  8. TUCOWS.COM2

Top-level domains

  1. .com20
  2. .app7
  3. .net4
  4. .dev3
  5. .club3
  6. .kr3
  7. .es2
  8. .co2

Hosting networks

  1. Cloudflare, Inc.8
  2. CLOUDFLARENET - Cloudflare, Inc., US4
  3. Microsoft Corporation3
  4. IONOS-AS IONOS SE, DE2
  5. Amazon.com, Inc.2
  6. AMAZON-02 - Amazon.com, Inc., US2
  7. Google LLC2
  8. Oracle Corporation2

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Santander; share of all PhishDestroy reports: 0.03%.