sm[.]saipymes[.]soporte-virtual[.]es

Analysis of the domain sm.saipymes.soporte-virtual.es confirms active phishing infrastructure targeting Santander customers. The domain, registered on November 14, 2020, is currently resolving to IPv6 address 2001:8d8:100f:f000::229 and is served by an Apache HTTP Server with a Sectigo Limited SSL certificate. The page title, 'Soporte – SERVICIO DE ASISTENCIA INFORMÁTICA 24 HORAS AL DÍA. 365 DÍAS AL AÑO,' does not explicitly reveal phishing content, but the domain is flagged for brand impersonation of Santander by multiple threat intelligence sources. Infrastructure review shows the domain appears on two security blocklists and is actively blocked by PhishDestroy and PhishingDB. Google Safe Browsing classifies the site under 'SOCIAL_ENGINEERING,' a designation consistent with credential-harvesting or fraudulent support scams. As of July 13, 2026, the domain remains operational, with 17 of 95 security vendors on VirusTotal detecting malicious activity. The Gridinsoft trust score of 0/100 further supports the high-risk assessment. Defenders should treat this domain as confirmed phishing infrastructure. Network-level blocking is recommended, particularly for financial institutions or organizations with ties to Santander. While the exact phishing kit or payload is not yet analyzed, the combination of brand impersonation, social engineering flags, and active blocklist presence justifies immediate mitigation. No evidence suggests this domain is legitimately affiliated with Santander or its authorized support services.