Phishing tracker flags Banco Santander phishing host santander.nfcobsidian.com
phishunt.io reported on X on 3 November 2026 that santander.nfcobsidian.com, registered on 1 November, hosts a Banco Santander phishing page with a fake card demagnetisation lure. Santander is not involved.
- First reported
- Reports
- 1
Source: x.com · published
What happened
Phishing tracker phishunt.io (@phishunt_io) posted on X on 3 November 2026 about a Banco Santander phishing site at santander[.]nfcobsidian[.]com. According to the post, the domain was registered on 1 November 2026, two days earlier. It resolves to the address 180.178.191.153, which belongs to 49 3 Networking (AS399979) in the United States. The post links phishunt's Santander tracking page, which lists the host as recently flagged. The domain nfcobsidian.com is not a Santander address.
How the scam works
The screenshot in the post shows a Santander-branded web page in Spanish headed “Desmagnetización de su medio de pago” (Demagnetisation of your means of payment). It claims that an online demagnetiser fixes magnetic disturbances that can affect the chip or magnetic stripe of a card, and that after logging in the user's phone will emit a neutralising signal through its NFC sensor, which the user should hold over the card. A box below asks for an “Número de empleado” (employee number).
The story does not describe a real banking procedure, so the page is best read as a lure. An NFC theme matches a pattern in which victims are tricked into tapping a card against a phone, which can lead to the card being read or an app being installed. The post's screenshot shows only the first screen, so what the site does after the form is submitted is not known. The post also does not say who was targeted, how the link was delivered or whether anyone lost money.
The tracker describes retail banking phishing as concentrated in Spain, the United Kingdom and Latin America. Santander's genuine sites and apps do not run off a subdomain of a recently registered, unrelated domain.
Source
@phishunt_io on X, post of 3 November 2026 (domain, registration date, hosting details and screenshot). Not independently verified by scammers.com.
Red flags
- A Santander page on a subdomain of a domain registered only two days earlier.
- A claim that a phone can demagnetise a bank card through NFC, which has no basis in banking practice.
- A login form asking for an employee number, which a customer would not have.
- An instruction to hold a card or phone against a device to complete a procedure.
- A web address that has no link to the bank's official domain.
If you were targeted
- 1Do not use santander.nfcobsidian.com or enter any details on it.
- 2Reach Santander only through its official app or an address you typed yourself.
- 3Never tap a payment card against your phone because a web page tells you to.
- 4If you entered details or tapped a card, call your bank on the number printed on the card and block it.
- 5Report phishing links to Santander and your national fraud reporting service.