leia-santander[.]vercel[.]app

This domain, leia-santander.vercel.app, is identified as an active brand impersonation threat targeting Santander Bank customers. Analysis indicates the site is designed to harvest login credentials, financial details, and personal information through a fraudulent interface mimicking the legitimate banking portal. No specific drainer kit signatures have been confirmed, but the infrastructure aligns with common phishing-as-a-service frameworks leveraging cloud hosting for rapid deployment. Infrastructure analysis reveals multiple high-confidence technical indicators. The domain was registered on February 21, 2026, through Tucows Domains Inc., and currently resolves to IP address 216.198.79.195, hosted on Amazon Web Services (AS16509). VirusTotal detection rates show 23 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as a phishing site. The domain appears on two security blocklists: PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services under the WR1 root, a common pattern observed in fraudulent deployments due to its low validation requirements. As of the latest assessment, leia-santander.vercel.app remains active and accessible, posing an ongoing risk to unsuspecting users. Immediate response actions include reporting the domain to hosting providers and certificate authorities for takedown, as well as notifying the targeted brand’s security team for brand protection measures. Despite these efforts, the domain’s cloud-based hosting and recent registration suggest potential resilience against rapid takedowns. Users are advised to avoid interaction with the site, verify URLs through official channels, and enable multi-factor authentication on financial accounts to mitigate credential theft risks.