santander[.]es-lineasegura[.]com

Analysis of the domain santander.es-lineasegura.com indicates it is a brand impersonation scam targeting Banco Santander's Linea services. The domain was registered on December 5, 2025, through Tucows Domains Inc. and currently resolves to the IP address 23.132.164.93, hosted on AS60223 Netiface in Germany. No SSL certificate is present, increasing the risk of unencrypted data interception. The page title, 'Banco Santander - Alerta de Seguridad Crítica,' suggests an attempt to mimic official Santander security alerts, a common tactic in phishing campaigns to induce urgency and prompt user action.

Infrastructure analysis reveals the domain uses nameservers associated with Njalla (1-you.njalla.no, 2-can.njalla.in, 3-get.njalla.fo), a provider frequently utilized for bulletproof hosting. The domain appears on one security blocklist, and 20 of 95 security vendors on VirusTotal flagged it as malicious at the time of scanning. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification.

The domain was taken offline, though defenders should remain vigilant for re-registration or migration to new infrastructure. Defenders are advised to block the domain and its resolving IP (23.132.164.93) at the perimeter, monitor for related domains using Njalla nameservers, and alert users to the impersonation of Santander security alerts. The exact content of the phishing page remains unanalyzed, but the combination of brand impersonation, lack of SSL, and detection by multiple security vendors confirms its malicious intent.