Concerned about recent PAN-OS and other firewall/VPN CVEs? Take advantage of Zscaler’s special offer today

Zscaler Blog

Get the latest Zscaler blog updates in your inbox

Security Research

Brazilian Bank Targeted by Phishing Site and DNS Poisoning

July 18, 2011 - 2 min read
Update 7/26: See post on our Scrapbook blog about details surrounding a recently poisoned BR nameserver involved in this fraud. -- Mike

Santander, a well-known banking site, has often been the target of phishers. In fact, Santander UK often makes the top-10 list of most popular targets according to Phishtank. Last week, we found a phishing site for the Brazilian branch,, that was receiving traffic from a DNS cache poisoning attack.

The phishing site hosted on looks identical to the original site. The attackers have replicated the entire login process in order to gather the login, password, and security code of the bank users.


Santander Brazil phishing site



Original Santander Brazil home page

The DNS poisoning made this attack much more effective. The hijacked DNS servers were resolving to (phishing site) instead of or (legitimate sites). In such a situation, phishers do not need to blast emails to random Brazilian email accounts. They just need to wait for the Santander customers to log in to their bank accounts when accessing the site via the poisoned DNS servers.

DNS poisoning also renders virtually all browser phishing defenses useless. Google Safe Browsing (Firefox, Safari, Chrome, etc.) and Phishtank (Opera, etc.) both rely on denylists, which are lists of URLs or domains to block. It can be very hard for the user to realize this is a phishing site because it looks exactly like the real site, and the URL shows the correct domain.

In this attack, there were only two oddities that advanced users could have spotted. First, the phishing site did not support HTTPS traffic. Advanced users should know that credentials should be sent over secure HTTPS sessions only, and banking sites always redirect to HTTPS enabled pages when the user must log in. The second clue is in the source of the page: the last line, an HTML comment, shows that the page was copied from the original site:


Last few lines of HTML code on the phishing site

A week later, the phishing site is still up. It is not blocked by Phishtank or Google Safe Browsing. However, the hijacked DNS servers have been cleaned up, making this site a lot less dangerous.

-- Julien



form submtited
Thank you for reading

Was this post useful?

dots pattern

Get the latest Zscaler blog updates in your inbox

By submitting the form, you are agreeing to our privacy policy.