sander-aul-crediapp[.]azurewebsites[.]net

This domain is flagged as a high-risk credential phishing site targeting users of Santander personal loan services. The page presents a fraudulent interface mimicking Santander’s official loan application portal, designed to harvest login credentials, personal identification details, and financial information from victims. The content is localized in Spanish, specifically referencing 'Préstamo Personal Santander,' indicating a targeted campaign against Spanish-speaking users seeking personal loans. Analysis indicates the domain is hosted on Microsoft Azure infrastructure, resolving to IP address 158.23.105.1. The SSL certificate is issued by Microsoft Corporation, a common pattern in phishing sites leveraging legitimate cloud services to evade detection. As of the latest scan, 13 out of 95 security vendors on VirusTotal have flagged this domain as malicious. The domain remains active, with no evidence of takedown or blocklisting by the registrar. Infrastructure analysis reveals the use of Azure App Services, a platform frequently abused for rapid deployment of phishing pages due to its ease of use and perceived legitimacy. Users who have visited this domain or entered credentials should immediately revoke any submitted information by contacting Santander’s official fraud department. All affected devices should undergo a full security scan to detect potential malware or unauthorized access. Credentials used on this site must be considered compromised and changed across all platforms where they were reused. Network administrators are advised to block the domain and its resolving IP (158.23.105.1) at the perimeter to prevent further exposure. Monitoring for unusual login attempts or financial transactions is recommended for affected individuals.