my[.]satanderbanco[.]online

my.satanderbanco.online is currently offline but historical data show it was used for credential phishing targeting the Satander Banco brand. The site presented the page title "Login | Satander Banco", indicating an attempt to harvest user credentials. Registration occurred on April 14, 2025 through Dynadot Inc and the domain resolved to the IPv4 address 198.12.80.250, which is allocated to AS36352 (HostPapa) in the United States. The hosting provider and IP have been listed on a single public blocklist and the domain is actively blocked by the PhishDestroy service.

The SSL certificate was issued with an R12 rating, suggesting a low‑trust certificate. VirusTotal analysis returned three positive detections out of ninety‑three scanners, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, indicating no confidence in the site’s legitimacy. The intelligence set classifies the operation as generic credential phishing; no additional malware kit or secondary payload information is available.

Uncertainty remains regarding current activity because the site is taken offline and no live HTTP response can be observed. Defenders should continue to enforce URL filtering against the domain and its associated IP address, update internal blocklists, and monitor for any resurrection of the domain or similar look‑alike registrations. Indicator sharing with threat‑intel platforms is recommended, and any attempted credential submissions to the URL should be logged and investigated.