# PhishDestroy domain threat record: meine-app.login-utilizator.de

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/meine-app.login-utilizator.de/
Machine-readable companion: https://phishdestroy.io/domain/meine-app.login-utilizator.de/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-11 08:30:11 UTC
- Last availability or vendor check: 2026-10-22 22:40:26 UTC
- Stored record updated: 2026-10-22 22:40:26 UTC
- VirusTotal detections in the stored snapshot: 6/92
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: apple

## Stored infrastructure

- Observed IP address: 94.183.188.35
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 200
- Registration date in stored WHOIS data: 2026-09-30 22:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a12a14-aced-703b-9165-e7162b5209d0/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/meine-app.login-utilizator.de
- Certificate Transparency search: https://crt.sh/?q=%25.meine-app.login-utilizator.de
- Web Archive lookup: https://web.archive.org/web/*/https://meine-app.login-utilizator.de/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
meine-app.login-utilizator.de is a credential phishing site that urlscan.io links to the Santander brand. It targets the bank's customers and anyone who receives a lure leading to a fake login. The hostname mixes German ("meine-app", my app) with Romanian ("login-utilizator", user login) to look like an official app sign-in. PhishDestroy first flagged it on 2026-10-11, and it was still online serving live content when last checked on 2026-10-19.

How the scam works
Victims usually arrive through a text message or email claiming a problem with their Santander account or app and urging them to sign in. The fake page collects the username, password and often one-time codes, then passes them to the operators. With those credentials they can log into the real account, approve transfers or enrol a new device before the victim notices. The browser tab reads "Domain Default page", which looks like an unconfigured server, while our classification and the scanner verdicts identify the site as Santander phishing.

Evidence
Several independent sources back the classification. Google Safe Browsing lists the site for social engineering, which triggers warnings in most major browsers. urlscan.io rated it malicious and detected Santander branding. On VirusTotal, 6 of 92 engines flagged it on 2026-10-12: alphaMountain.ai, CRDF, DNS8, Gridinsoft, SOCRadar and Webroot. That count is modest, so many security tools may still let the page load without warning. The domain is also listed on the PhishDestroy and PhishFeed blocklists.

Infrastructure
The site resolves to 94.183.188.35 on the AS56971 Cloud network in France. It uses a free, automatically issued Let's Encrypt certificate, so the padlock only means the connection is encrypted. It says nothing about who runs the site or whether it is really Santander.

What to do
If you entered your Santander credentials here, change your online banking password right away from the official app or the bank's real website. Call Santander using the number on your card so the bank can block suspicious transfers and remove any devices you don't recognise. Check recent transactions and payees, and change the password on any other service where you reused it. Treat any SMS codes you typed in as compromised, and be wary of follow-up calls from people posing as bank staff. Defenders should block the domain and its IP at mail and web gateways, and search logs for users who visited it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a12a14-aced-703b-9165-e7162b5209d0/
VirusTotal report: https://www.virustotal.com/gui/domain/meine-app.login-utilizator.de
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=meine-app.login-utilizator.de
Archived copy: https://web.archive.org/web/20261011082934/https://meine-app.login-utilizator.de/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:26:52 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/v6Z2TyRj/575df19e7c95.png
  Captured: 2026-10-11 08:30:11 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a12a14-aced-703b-9165-e7162b5209d0.png
  Captured: 2026-10-11 08:30:11 UTC
  Source report: https://urlscan.io/result/01a12a14-aced-703b-9165-e7162b5209d0/
- URLScan capture 2: https://urlscan.io/screenshots/01a1293a-7949-751d-a53a-6e07dcf59051.png
  Captured: 2026-10-11 08:27:03 UTC
  Source report: https://urlscan.io/result/01a12a14-aced-703b-9165-e7162b5209d0/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/802d9ba6-426b-4c06-9507-92367a88de15.png
  Captured: 2026-10-12 10:41:49 UTC
  Source report: https://radar.cloudflare.com/scan/802d9ba6-426b-4c06-9507-92367a88de15
  SHA-256: ac41f0cafb26badbb1ed7700abaf63587047c6c6692bf398b3dac7bf9377c762
- URLScan · 2026-10-08: https://screenshots.phishdestroy.io/us/01a11b81-6348-72e2-ad0e-8dbdbcea26a1.png
  Captured: 2026-10-08 12:33:53 UTC
  Source report: https://urlscan.io/result/01a11b81-6348-72e2-ad0e-8dbdbcea26a1/
  SHA-256: bb022869a264da0940a73cd4ffd04bf29d0208a929e0a633fe78a8b3f8c121f2
- URLScan · 2026-10-09: https://screenshots.phishdestroy.io/us/01a12231-b0cf-776c-938e-e0308c484407.png
  Captured: 2026-10-09 19:44:12 UTC
  Source report: https://urlscan.io/result/01a12231-b0cf-776c-938e-e0308c484407/
  SHA-256: 862c9be80d6381a4e5a9705d3fa3756ef3dcda08fbc666f95fb78105884426d8
- URLScan · 2026-10-14: https://screenshots.phishdestroy.io/us/01a1382d-31ab-756d-a807-f74b44231083.png
  Captured: 2026-10-14 02:10:53 UTC
  Source report: https://urlscan.io/result/01a1382d-31ab-756d-a807-f74b44231083/
  SHA-256: 862c9be80d6381a4e5a9705d3fa3756ef3dcda08fbc666f95fb78105884426d8
- URLScan · 2026-10-17: https://screenshots.phishdestroy.io/us/01a14ab3-57b1-756b-a644-a83e74aaf264.png
  Captured: 2026-10-17 16:30:38 UTC
  Source report: https://urlscan.io/result/01a14ab3-57b1-756b-a644-a83e74aaf264/
  SHA-256: 3643a312b03e66ed9372529dcc8ab41bfd70744f9d3812a07816ee9c23655dcf
- URLScan · 2026-10-18: https://screenshots.phishdestroy.io/us/01a14ed9-0097-70cc-8184-3ea0502b212c.png
  Captured: 2026-10-18 11:50:13 UTC
  Source report: https://urlscan.io/result/01a14ed9-0097-70cc-8184-3ea0502b212c/
  SHA-256: 862c9be80d6381a4e5a9705d3fa3756ef3dcda08fbc666f95fb78105884426d8
- URLScan · 2026-10-21: https://screenshots.phishdestroy.io/us/01a15c1c-604a-72db-9ccc-ec218e98cacf.png
  Captured: 2026-10-21 01:38:53 UTC
  Source report: https://urlscan.io/result/01a15c1c-604a-72db-9ccc-ec218e98cacf/
  SHA-256: 3643a312b03e66ed9372529dcc8ab41bfd70744f9d3812a07816ee9c23655dcf

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T18:32:43Z",
        "uuid": "01a12a14-aced-703b-9165-e7162b5209d0",
        "scanned_at": "2026-10-11T08:29:29Z",
        "final_url": "https://meine-app.login-utilizator.de/portal/openlogin/",
        "status": 200,
        "redirected": "same-domain",
        "redirects": [
            {
                "to": "https://meine-app.login-utilizator.de/portal/openlogin",
                "from": "http://meine-app.login-utilizator.de/portal/openlogin",
                "status": 307
            },
            {
                "to": "https://meine-app.login-utilizator.de/portal/openlogin/",
                "from": "https://meine-app.login-utilizator.de/portal/openlogin",
                "status": 301
            }
        ],
        "ip": "94.183.188.35",
        "domains": [
            "ipwho.is"
        ],
        "ips": [
            "104.20.44.133",
            "94.183.188.35"
        ],
        "asns": [
            "13335",
            "56971"
        ],
        "countries": [
            "FR"
        ],
        "doc_hash": "b9e7bbe69bbc8d92d0674c3e3ff1babc90cbe985860f11f7a60db8222f2f470a",
        "script_hashes": [
            "910a4c1da6bf27aa5f5d8c4fedbf4b530a2bde5cb4354c60622d11615e073ba8"
        ],
        "globals": [
            "RojaSync",
            "loginForm",
            "usernameInput",
            "passwordInput",
            "togglePassword",
            "eyeIcon",
            "submitBtn"
        ],
        "storage_keys": [
            "roja_visitor_id",
            "roja_client_geo",
            "roja_client_ip",
            "roja_online"
        ],
        "tls": {
            "san": [
                "meine-app.login-utilizator.de"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YR2",
            "subject": "meine-app.login-utilizator.de",
            "protocol": "TLS 1.3",
            "valid_to": "2027-01-03T00:21:11Z",
            "valid_from": "2026-10-05T00:21:12Z"
        },
        "domain_age_days": 4,
        "apex_age_days": 10,
        "tls_age_days": 6,
        "tls_valid_days": 89,
        "requests": 15,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "santander"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Santander"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "nginx",
            "content-type": "text/html",
            "x-powered-by": "PleskLin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T18:43:58Z",
        "uuid": "802d9ba6-426b-4c06-9507-92367a88de15",
        "scanned_at": "2026-10-12T10:41:49Z",
        "final_url": "https://meine-app.login-utilizator.de/",
        "status": 200,
        "history": [
            {
                "url": "https://meine-app.login-utilizator.de/",
                "status": 200
            }
        ],
        "dom_hash": "16ea3f6e8e1823e5e4a6efdb9e2f7bc0145b019122c05ec5457ce8172e330867",
        "doc_hash": "6c703476d7302eb4ff2847f45852c235adfb9eacd32f39cf0610a818fa33738e",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "meine-app.login-utilizator.de",
                "type": "A",
                "value": "94.183.188.35"
            }
        ],
        "dnssec_valid": false,
        "ip": "94.183.188.35",
        "whois": {
            "updated": "2026-10-01T01:17:09Z",
            "nameservers": [
                "ignat.ns.cloudflare.com",
                "monroe.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T02:37:03Z",
        "analysis_at": "2026-10-20T16:51:42Z",
        "stats": {
            "timeout": 0,
            "harmless": 43,
            "malicious": 15,
            "suspicious": 3,
            "undetected": 31
        },
        "detections": {
            "CRDF": "malicious",
            "DNS8": "suspicious",
            "ESET": "suspicious",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "Fortinet": "spam",
            "SOCRadar": "phishing",
            "URLQuery": "malicious",
            "LevelBlue": "phishing",
            "Phishtank": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Google Safe Browsing": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2026-10-01T00:00:00Z",
        "first_seen": "2026-10-07T23:09:03Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "94.183.188.35"
            }
        ],
        "dns_at": "2026-10-20T16:52:00Z",
        "jarm": "29d3fd00029d29d00042d43d0000002059a3b916699461c5923779b77cf06b",
        "cert": {
            "san": [
                "meine-app.login-utilizator.de"
            ],
            "issuer": "Let's Encrypt / YR2",
            "serial": "6a66e53643d8aea9243b706505848618b09",
            "sha256": "c03e0217fb146c63b08e658038ca5799a4d9c2f819b9c1299a57ab753a3fd6bb",
            "subject": "meine-app.login-utilizator.de",
            "valid_to": "2027-01-03T00:21:11Z",
            "valid_from": "2026-10-05T00:21:12Z"
        },
        "whois": []
    }
}
```