# Phishing sites impersonating Santander

PhishDestroy has recorded 60 phishing domains impersonating Santander since 2025-08-16, 2 of them in the last 30 days. The most used registrars are DYNADOT and Cloudflare; the most common TLDs are .com and .app. Open Santander only from its official app or a saved bookmark.

60Domains, all time

2Last 30 days

31Online at last check

7Confirmed takedowns

## New domains in the last 90 days

Santander phishing domains detected per day: 17 from 2026-07-25 to 2026-10-22; peak 2.

## How to tell a fake Santander site

Words most often added to the brand in reported domains: santandermx, san, dothome, hosted, portal, mybluehost, sander, aul, staticfile, wasmer.
- Type the address yourself or use a bookmark; phishing links for Santander arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Santander does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Santander phishing domains

The 50 most recently detected domains impersonating Santander
Domain | First detected | Status at last check | Registrar | 
[santander-newbusiness.es](https://phishdestroy.io/domain/santander-newbusiness.es/) | 2026-10-13 | Online | — | 
[santander-gt.com](https://phishdestroy.io/domain/santander-gt.com/) | 2026-09-26 | Online | NOMINALIA INTERNET S.L | 
[santander-remaster-whats-fb.vercel.app](https://phishdestroy.io/domain/santander-remaster-whats-fb.vercel.app/) | 2026-09-17 | Online | Vercel | 
[php-web-server--militarymandril.replit.app](https://phishdestroy.io/domain/php-web-server--militarymandril.replit.app/) | 2026-09-14 | Online | Replit | 
[observatoriologisticodesantander.com](https://phishdestroy.io/domain/observatoriologisticodesantander.com/) | 2026-08-24 | Online | GoDaddy.com | 
[santander-invest.org](https://phishdestroy.io/domain/santander-invest.org/) | 2026-08-24 | Offline | DYNADOT | 
[bancosantander-es.muttinfo.com](https://phishdestroy.io/domain/bancosantander-es.muttinfo.com/) | 2026-08-23 | Offline | Wild West Domains | 
[comercialbancosantanderconsigorg.org](https://phishdestroy.io/domain/comercialbancosantanderconsigorg.org/) | 2026-08-23 | Online | Squarespace Domains II | 
[santander.pt-atendimento.com](https://phishdestroy.io/domain/santander.pt-atendimento.com/) | 2026-08-14 | Offline | OwnRegistrar | 
[santanderinvest.com](https://phishdestroy.io/domain/santanderinvest.com/) | 2026-08-10 | Online | Cosmotown | 
[websantander1.dothome.co.kr](https://phishdestroy.io/domain/websantander1.dothome.co.kr/) | 2026-08-08 | Online | Inames , (http://www.inames.kr) | 
[santandermx.github.io](https://phishdestroy.io/domain/santandermx.github.io/) | 2026-08-06 | Offline | GitHub | 
[santanderweb.dothome.co.kr](https://phishdestroy.io/domain/santanderweb.dothome.co.kr/) | 2026-08-05 | Online | Inames , (http://www.inames.kr) | 
[santandermx.dothome.co.kr](https://phishdestroy.io/domain/santandermx.dothome.co.kr/) | 2026-08-02 | Online | Inames , (http://www.inames.kr) | 
[satander2026.netlify.app](https://phishdestroy.io/domain/satander2026.netlify.app/) | 2026-08-01 | Offline | Netlify | 
[santander-protocolo.com](https://phishdestroy.io/domain/santander-protocolo.com/) | 2026-07-31 | Online | Registrar.eu | 
[staticfile-sntandre.wasmer.app](https://phishdestroy.io/domain/staticfile-sntandre.wasmer.app/) | 2026-07-25 | Offline | Wasmer | 
[ecokidsarttw.com](https://phishdestroy.io/domain/ecokidsarttw.com/) | 2026-07-23 | Offline | Network Solutions | 
[creditos-2026mx.webcindario.com](https://phishdestroy.io/domain/creditos-2026mx.webcindario.com/) | 2026-07-23 | Offline | TUCOWS.COM | 
[sankaterd.click](https://phishdestroy.io/domain/sankaterd.click/) | 2026-07-19 | Offline | Dynadot | 
[402d8b54-a79e-4025-8d53-334b3607fbd1.clouding.host](https://phishdestroy.io/domain/402d8b54-a79e-4025-8d53-334b3607fbd1.clouding.host/) | 2026-07-17 | Offline | MarkMonitor | 
[maxicre-aul-apl-san.azurewebsites.net](https://phishdestroy.io/domain/maxicre-aul-apl-san.azurewebsites.net/) | 2026-07-07 | Offline | Microsoft Azure | 
[staticfile-878b7.wasmer.app](https://phishdestroy.io/domain/staticfile-878b7.wasmer.app/) | 2026-07-07 | Unknown | Wasmer | 
[acceso-sander-app-website.azurewebsites.net](https://phishdestroy.io/domain/acceso-sander-app-website.azurewebsites.net/) | 2026-07-07 | Offline | Microsoft Azure | 
[sander-aul-crediapp.azurewebsites.net](https://phishdestroy.io/domain/sander-aul-crediapp.azurewebsites.net/) | 2026-07-07 | Offline | Microsoft Azure | 
[highmarket.my](https://phishdestroy.io/domain/highmarket.my/) | 2026-07-06 | Online | DYNADOT | 
[santaner.sbs](https://phishdestroy.io/domain/santaner.sbs/) | 2026-07-03 | Offline | DYNADOT | 
[santander-portugal.com](https://phishdestroy.io/domain/santander-portugal.com/) | 2026-07-02 | Online | Registrar.eu | 
[pt-multibanco.com](https://phishdestroy.io/domain/pt-multibanco.com/) | 2026-06-26 | Unknown | NICENIC | 
[plearnthaipalace.com](https://phishdestroy.io/domain/plearnthaipalace.com/) | 2026-06-23 | Online | TUCOWS.COM | 
[santandercycling.com.co](https://phishdestroy.io/domain/santandercycling.com.co/) | 2026-06-21 | Online | Cloudflare | 
[minabus.cl](https://phishdestroy.io/domain/minabus.cl/) | 2026-06-19 | Online | NIC Chile | 
[santunion.club](https://phishdestroy.io/domain/santunion.club/) | 2026-06-16 | Online | DYNADOT | 
[pensilvania.club](https://phishdestroy.io/domain/pensilvania.club/) | 2026-06-16 | Offline | DYNADOT | 
[sanderunion.club](https://phishdestroy.io/domain/sanderunion.club/) | 2026-06-15 | Online | Dynadot | 
[santanderbank.com.cobblestonesw.com](https://phishdestroy.io/domain/santanderbank.com.cobblestonesw.com/) | 2026-06-07 | Online | Cloudflare | 
[santanderaumenta.pages.dev](https://phishdestroy.io/domain/santanderaumenta.pages.dev/) | 2026-05-07 | Taken down | Cloudflare | 
[contribuinte-fazendapr2026.com](https://phishdestroy.io/domain/contribuinte-fazendapr2026.com/) | 2026-05-05 | Taken down | PublicDomainRegistry.com | 
[santander-vilkas.pages.dev](https://phishdestroy.io/domain/santander-vilkas.pages.dev/) | 2026-04-21 | Taken down | Cloudflare | 
[link.hiper-ofertas.com](https://phishdestroy.io/domain/link.hiper-ofertas.com/) | 2026-04-10 | Online | GoDaddy.com | 
[nhh.khd.mybluehost.me](https://phishdestroy.io/domain/nhh.khd.mybluehost.me/) | 2026-04-06 | Online | Domain.com | 
[ggg.ixo.mybluehost.me](https://phishdestroy.io/domain/ggg.ixo.mybluehost.me/) | 2026-03-31 | Online | Domain.com | 
[seguroseguroautosoap.sbs](https://phishdestroy.io/domain/seguroseguroautosoap.sbs/) | 2026-03-19 | Offline | NameSilo | 
[galleta.jdevcloud.com](https://phishdestroy.io/domain/galleta.jdevcloud.com/) | 2026-03-14 | Offline | — | 
[santstest.live](https://phishdestroy.io/domain/santstest.live/) | 2026-03-14 | Offline | Name.com | 
[policy-portal.dev.san.kpmgcdd-fincrime.com](https://phishdestroy.io/domain/policy-portal.dev.san.kpmgcdd-fincrime.com/) | 2026-03-11 | Online | Amazon Registrar | 
[san-mobile.xyz](https://phishdestroy.io/domain/san-mobile.xyz/) | 2026-02-26 | Offline | — | 
[santander-connectchat.com](https://phishdestroy.io/domain/santander-connectchat.com/) | 2026-02-26 | Offline | CNOBIN INFORMATION TECHNOLOGY | 
[particularessantander.kinsta.cloud](https://phishdestroy.io/domain/particularessantander.kinsta.cloud/) | 2026-02-26 | Offline | MarkMonitor | 
[santanderbamk.co](https://phishdestroy.io/domain/santanderbamk.co/) | 2026-02-19 | Offline | Web Commerce Communications | 

[All 60 Santander reports](https://phishdestroy.io/domain/?brand=Santander)

## Where they are registered and hosted

### Registrars

- [DYNADOT](https://phishdestroy.io/registrar/dynadot/)5
- Cloudflare4
- Microsoft Azure3
- Inames , (http://www.inames.kr)3
- [Tucows Domains](https://phishdestroy.io/registrar/tucows/)2
- Domain.com2
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)2
- [TUCOWS.COM](https://phishdestroy.io/registrar/tucows/)2

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)20
- [.app](https://phishdestroy.io/tld/app/)7
- [.net](https://phishdestroy.io/tld/net/)4
- [.dev](https://phishdestroy.io/tld/dev/)3
- [.club](https://phishdestroy.io/tld/club/)3
- [.kr](https://phishdestroy.io/tld/kr/)3
- [.es](https://phishdestroy.io/tld/es/)2
- [.co](https://phishdestroy.io/tld/co/)2

### Hosting networks

- Cloudflare, Inc.8
- CLOUDFLARENET - Cloudflare, Inc., US4
- Microsoft Corporation3
- IONOS-AS IONOS SE, DE2
- Amazon.com, Inc.2
- AMAZON-02 - Amazon.com, Inc., US2
- Google LLC2
- Oracle Corporation2

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Santander; share of all PhishDestroy reports: 0.03%.

Canonical: https://phishdestroy.io/brand/santander/