policy-portal[.]dev[.]san[.]kpmgcdd-fincrime[.]com

This domain, policy-portal.dev.san.kpmgcdd-fincrime.com, poses a significant threat of brand impersonation, specifically targeting the Santander brand. The website's title 'Santander' and its resemblance to legitimate Santander web portals can mislead users into believing they are interacting with an official Santander service, potentially leading to the disclosure of sensitive information such as login credentials, personal data, or financial details.

Analysis indicates that the domain was created on March 11, 2026, and is registered through Amazon Registrar, Inc. It resolves to the IP address 52.209.53.162, which is located in Ireland and associated with AS16509 Amazon.com, Inc. The domain has been flagged by 22 out of 95 security vendors on VirusTotal, and it appears on one security blocklist. These detections and the domain's short lifespan suggest that it was likely set up for a short-term malicious campaign and was subsequently taken offline. The SSL certificate is issued by Let's Encrypt, which is common for both legitimate and phishing sites, but in this context, it further legitimizes the fraudulent nature of the domain.

If a user has visited this domain, they should immediately check their account activity for any unauthorized transactions or changes. It is recommended to change any passwords or credentials that may have been entered on the site and enable two-factor authentication (2FA) for added security. Users should also monitor their financial statements and credit reports for any unusual activity. If any suspicious activity is detected, they should report it to Santander and their local cybersecurity authorities.