staticfile-878b7[.]wasmer[.]app

This domain is flagged as a high-risk phishing site targeting financial credentials under the guise of Santander personal loans. Analysis indicates a deliberate impersonation of a legitimate banking service, with the page title explicitly displaying 'Préstamo Personal Santander,' a clear indicator of fraudulent intent. The domain remains active, posing an immediate threat to users seeking loan-related services. Infrastructure analysis reveals multiple red flags. The domain is registered through Wasmer and resolves to the IP address 62.210.172.150. Security vendors on VirusTotal have flagged this domain, with 14 out of 95 detections confirming malicious activity. The SSL certificate is issued by Let's Encrypt, a common tactic used by threat actors to lend superficial legitimacy to phishing sites. No reputable blocklists or trust scores currently provide additional context, but the combination of domain registration details, page content, and detection rates solidifies its classification as a phishing threat. Mitigation steps specific to this threat type include immediate blocking of the domain and its associated IP address within network security controls. Financial institutions and users should be alerted to the presence of this phishing campaign, particularly those targeting Spanish-speaking customers. Organizations are advised to monitor for credential harvesting attempts linked to this domain and implement multi-factor authentication (MFA) to mitigate the risk of compromised accounts. Proactive threat hunting for related indicators, such as the domain name or IP address, is recommended to identify and neutralize any residual exposure.