santander.nfcobsidian.com
Category: Phishing
- Don't sign in or pay here. Close it. If you typed a password, change it where you normally use it.
- Already visited? Check your device. A free scan shows whether anything was installed.
- Stop the next one. Combo Cleaner's web protection blocks phishing and scam sites before they load.
Combo Cleaner is PCrisk's own anti-malware tool, owned by RCS LT. Free to scan; removing what it finds needs a licence (7-day free trial).
Description of santander.nfcobsidian.com
The domain santander.nfcobsidian.com appears to host a page that presents itself as Banco Santander and uses Spanish-language banking-themed content. The visible page title, "Desmagnetización de su medio de pago," and the form fields for employee number and PIN suggest it is designed to collect login or payment-related information from visitors.
Based on the page content provided, this does not appear to be an official Santander domain. Instead, it appears to be a look-alike page placed on a separate parent domain, nfcobsidian.com, while displaying Santander branding and imagery. The site seems intended to imitate a financial institution login or verification workflow rather than provide independent informational content.
Safety Assessment for santander.nfcobsidian.com
This website appears to be a phishing page impersonating Banco Santander and asking visitors to log in or submit account, card, or identity-related details. The domain closely resembles Santander's official web presence by placing the brand name in a subdomain, which may mislead visitors into believing they are interacting with the bank. Multiple security engines flagged the URL as phishing or malicious at the time of this scan, which is a strong risk indicator.
Additional context increases concern: the domain is only 2 days old, has no established traffic ranking, and the page reportedly presents itself as a well-known company it does not belong to. Threat-database results were mixed, with one content-focused blacklist indicating a malicious listing and the domain's IP address also appearing on one mail-reputation blocklist; while that mail-reputation signal alone would be a weaker indicator, it adds to the overall pattern here. Although the page-level malware scan did not detect flagged files at the time of scanning, that does not outweigh the phishing indicators and brand impersonation signals.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid Let's Encrypt SSL certificate and is served over nginx from an IP address geolocated to Islamabad, Pakistan, based on available hosting data. The certificate's presence indicates encrypted transport, but HTTPS alone does not verify that the operator is the claimed brand. DNSSEC appears to be unsigned, and the domain uses nameservers on 69host.cc.
From an infrastructure perspective, the domain is very newly registered and uses a separate parent domain rather than an official Santander-owned domain, which is a notable concern in combination with the page's branding. No malicious files or iframes were flagged in the limited page scan provided, but the broader reputation and impersonation signals are substantially more significant here.
Share your experience with this website. Was it safe? Did you encounter any issues?