santandermx[.]azurewebsites[.]net

The domain santandermx.azurewebsites.net was observed resolving to the IPv4 address 158.23.105.1. The address belongs to ASN 8075, registered to Microsoft Corporation, and geolocates to Mexico. DNS resolution is serviced by ns1-azure.azure-dns.com, confirming the use of Azure DNS infrastructure. No TLS certificate was presented for the host, indicating that any HTTP communication would be unencrypted. The only visible page title returned by the server is “v0 App”, which does not reveal malicious functionality but also provides no legitimate context. VirusTotal has recorded 14 detections out of 95 scanned engines, demonstrating consensus among multiple security vendors that the domain is malicious.

Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy service. Registration details show the domain was provisioned through Microsoft Corporation, consistent with the Azure hosting environment. Brand‑target analysis indicates the domain is intended to impersonate Santander, classifying the activity as brand impersonation. The current operational status is offline, but the historical artifacts remain relevant for threat‑intel correlation.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanisms, as no page content, HTTP response codes, or Java‑script artifacts have been publicly disclosed. Additionally, the lack of an SSL certificate prevents verification of any secure data exfiltration paths. Defenders should continue to block the domain at DNS and proxy layers, ingest the IP address 158.23.105.1 into network‑level deny lists, and monitor Azure‑related hostnames for re‑use. Updating endpoint and web‑gateway signatures with the observed detection patterns is advised. Regularly reviewing blocklist feeds for re‑appearance of the domain or similar Azure‑hosted subdomains will help mitigate recurrence.