santanderbank.shop - phishunt.io

Banco Santander

http://santanderbank.shop Access site

Screenshot

Investigate

Domain santanderbank.shop0 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

See every phishunt record for this domain

IP 13.248.169.48

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL http://santanderbank.shop

urlscan

Wayback

archive.today

Cert -

crt.sh

Censys

Google CT

Phishunt analysis Beta

33 medium suspicion suspiciousheuristic risk score · not a probability

Why?

+5.3 Keyword match
+5.1 Site cluster
+4.1 Brand in screenshot
+3.7 Brand in domain label
+3.2 Young domain
+3.0 TweetFeed
+2.2 Country mismatch
+1.2 ASN reputation
+1.1 No CSP header
+1.1 No HSTS header
+0.9 No registrar lock
+0.7 Bulletproof DNS
+0.7 Suspicious TLD
+0.6 Registrar reputation
+0.4 Long domain
+0.1 External scripts

18 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

A fake Santander Bank site using an anomalous .shop TLD, hosted on Amazon AWS in the US while the real bank operates primarily in Europe. Newly registered with minimal RDAP data and confirmed by TweetFeed, targeting customers with Santander branding to harvest online banking credentials.

TweetFeedBrand in domain labelNo registrar lock

AI-generated from stored detector signals - the AI never visited the site. · 2026-07-27 · confidence 70%

Domain & Network

Whois

Registrar Dynadot Inc.

Network

IP 13.248.169.48

Country