santander-portugal-demo[.]webflow[.]io

PhishDestroy identifies santander-portugal-demo.webflow.io as a high-risk generic phishing domain actively impersonating Santander Portugal. The site presents a deceptive login page designed to steal credentials from visitors expecting the legitimate Santander banking portal. No specific crypto drainer kit was detected, but the fake login mechanism poses significant financial and identity theft risks.

Technical analysis reveals that the domain resolves to IP address 172.64.151.8 and is registered through Webflow. VirusTotal data shows 18 out of 95 security vendors flag this domain as malicious, and it appears on one security blocklist. The SSL certificate is issued by Google Trust Services under the issuer WE1, lending a false sense of legitimacy to the phishing site.

As of this report, the domain remains active and accessible. No takedown action has been taken, and the phishing campaign continues to pose a threat to users. PhishDestroy recommends that individuals avoid interacting with this domain and always verify banking websites directly through official channels. If credentials have been entered, users should change passwords immediately and enable two-factor authentication on their accounts.