santanderbizum[.]com

This domain, santanderbizum.com, is a high-risk phishing site designed to impersonate the legitimate Santander Bizum payment service. Analysis indicates the page mimics the official Santander Bizum login portal, likely to harvest user credentials, payment details, or other sensitive financial information. The fraudulent site uses a deceptive interface matching Santander’s branding, increasing the likelihood of successful social engineering attacks against unsuspecting users attempting to access mobile banking or payment services. Infrastructure analysis reveals multiple technical indicators confirming malicious intent. The domain was registered on December 30, 2025, through Atak Domain, a registrar frequently associated with fraudulent activity. It resolves to the IP address 163.61.188.7 and uses a Let’s Encrypt SSL certificate, which, while providing encryption, does not validate legitimacy. VirusTotal detection shows 11 out of 95 security vendors flagging the domain as malicious, with classifications including phishing and brand impersonation. The page title, 'Home - Santanderbizum,' further reinforces the attempt to deceive users into believing they are interacting with an official Santander service. Users who have visited santanderbizum.com or entered credentials on the site should take immediate action to mitigate potential compromise. Affected individuals should change passwords for any accounts accessed after visiting the domain, particularly banking and email credentials. Enable multi-factor authentication where available to add an additional security layer. Monitor financial statements for unauthorized transactions and report any suspicious activity to the relevant financial institution. Security teams should block the domain and associated IP address (163.61.188.7) at the network level to prevent further access. If payment details were entered, contact the bank to request card replacement or account monitoring for fraudulent activity.