santderlokaty[.]pl

This domain, santderlokaty.pl, was identified as a brand‑impersonation site targeting Facebook. The site’s page title, “Lokacja terminowa – Santander”, does not reference the victim brand, indicating that the domain may have been repurposed solely for malicious use. Registration data shows the domain was created on 7 October 2025 through Realtime Register B.V., and it is hosted on IP 46.202.156.29, which belongs to AS47583 (Hostinger International Limited) in Germany. No SSL certificate is present, and the site is currently offline, confirming that the malicious content is not actively reachable at the time of analysis.

Threat intelligence flags the domain on a single security blocklist and records a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal analysis reports that 18 of 95 scanning engines flagged the domain, reinforcing the suspicion. AlienVault OTX lists the domain in 18 separate threat‑intel pulses, providing additional corroboration from the broader community. The domain is also listed as blocked by PhishDestroy.

Defenders should immediately add santderlokaty.pl to DNS and proxy blocklists, enforce TLS inspection policies for traffic to 46.202.156.29, and monitor for any future re‑hosting of the domain. Given the affiliation with Hostinger’s IP range, scrutinizing other domains resolving to the same host may uncover related campaigns. Continuous observation of the registrar Realtime Register B.V. for new domain registrations that mimic the naming pattern could provide early warning of similar brand‑impersonation attempts. Because the site is offline, active response is limited to preventative controls; however, logging of any connection attempts to the IP address or domain will aid in detecting potential resurgence.