Phishing detection: santander-protocolo.com

Banco Santander
https://santander-protocolo.com Access site
Screenshot
No screenshot available yet Captured automatically on the next refresh cycle
Investigate
Domain santander-protocolo.com0 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 45.74.47.19
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://santander-protocolo.com
urlscan Wayback archive.today
Cert Let's Encrypt
crt.sh Censys Google CT
Phishunt analysis Beta
27 low suspicionheuristic risk score · not a probability
Keyword matchBrand in domain labelurlscan.io
17 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates Santander bank using a custom domain combining the brand name with the word 'protocolo,' suggesting a fake security or verification page. Hosted by SLAYER GROUP LIMITED in Germany and flagged by urlscan, it appears designed to harvest banking credentials.

Brand in domain labelKeyword matchurlscan.io
AI-generated from stored detector signals - the AI never visited the site. · 2026-07-31 · confidence 72%
Domain & Network
Whois
Registrar Hosting Concepts B.V. d/b/a Registrar.eu
Network
IP 45.74.47.19
Country GermanyGermany
Hosting SLAYER GROUP LIMITED
ASN AS213441
TLS Cert Let's Encrypt
External detection urlscan.io
CleanGoogle Safe Browsing · OpenPhish · PhishTank · TweetFeed · SANS ISC
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-07-31 00:26 UTC  ·  Last refreshed 2026-08-04 13:30 UTC