public company · US
Itaú Unibanco
Itau Unibanco Holding S.A.
- Primary official domain
- itau.com.br
- Reviewed official domains
- 1 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- itauunibanco
- Label aliases
- Itaú Unibanco · Itau
- Official domains
- itau.com.br (all)
- Generated spellings
- 232 tracked · 16 observed somewhere · 216 not observed (all)
- Can receive mail
- 6 spellings and 0 reported domains publish MX records · mail at _dc-mx.cd32af8c0c13.itu.com.br 1 · alt1.us.email.fireeyecloud.com 1 · Google 1 · 3 more (16 spellings and 1 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Generated spellings we track
Spellings generated from this organization's official domains and brand tokens (typos, keyboard slips, lure words, look-alike characters, other top-level domains). Each one is checked against phishing feeds, certificate logs and DNS. A spelling that exists is not a finding and not a verdict: it may be unrelated, legitimate or registered defensively.
Other top-level domain 3 tracked · 3 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
itau[.]com | itau.com.br | Not observed | Logged 2026-10-19 – 2026-10-2052 certificates, 36 names | Alive200.196.152.201Itau Unibanco S.A. (AS15256) · BRlast answered 2026-10-19 | MXSPFDMARCmail at post01.itau.com.br · DMARC policy reject · checked 2026-10-19 | Observed |
itau[.]co | itau.com.br | Not observed | Not observed | Alive23.212.249.85AkamaiAkamai (AS20940) · NLa23-212-249-85.deploy.static.akamaitechnologies.com23.212.249.71AkamaiAkamai (AS20940) · NLa23-212-249-71.deploy.static.akamaitechnologies.comlast answered 2026-10-19 | MXSPFDMARCmail at alt1.us.email.fireeyecloud.com · DMARC policy reject · sends via Microsoft 365, Postmark, Mailgun, spf1.itau.co +2 · checked 2026-10-19 | Observed |
itau[.]live | itau.com.br | Not observed | Not observed | Alive34.174.204.65Google CloudGoogle Cloud (AS396982) · US65.204.174.34.bc.googleusercontent.comlast answered 2026-10-19 | MXSPFDMARCmail at MailSpamProtection (mail security gateway) · DMARC policy none (monitor only) · sends via itau.live.spf.auto.dnssmarthost.net · checked 2026-10-19 | Observed |
Character omitted 1 tracked · 1 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
itu[.]com[.]br | itau.com.br | Not observed | Not observed | Alive104.21.87.157CloudflareCloudflare (AS13335) · US172.67.144.80CloudflareCloudflare (AS13335) · USlast answered 2026-10-19 | MXSPFDMARCmail at _dc-mx.cd32af8c0c13.itu.com.br · sends via _spf.admincontrolpanel.com · checked 2026-10-19 | Observed |
Vowel changed 2 tracked · 2 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
itao[.]com[.]br | itau.com.br | Not observed | Not observed | Alive191.6.218.116CYBERWEB NETWORKS LTDA (AS28299) · BRweb-ded-395008a.kinghost.netlast answered 2026-10-19 | MXSPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARCmail at KingHost (web / mail hosting) · DMARC policy none (monitor only) · sends via KingHost, Google, Microsoft 365 · checked 2026-10-19 | Observed |
atau[.]com[.]br | itau.com.br | Not observed | Not observed | Alive172.67.193.31CloudflareCloudflare (AS13335) · US104.21.11.243CloudflareCloudflare (AS13335) · USlast answered 2026-10-19 | MXSPFDMARCmail at Google (consumer mailbox) · DMARC policy none (monitor only) · sends via Mailchimp · checked 2026-10-19 | Observed |
Last feed and certificate-log check 2026-10-19 05:45 UTC. “Not observed” means none of our checks has seen the spelling; it is not proof the name is unregistered. “Newly registered” means the spelling appeared in a newly-registered-domain list or as a new name in a zone file on that day (sources and terms on the Sources page); it is not a registration date. An observed spelling is not a finding: reported abuse appears only under Reported matches, from independent source evidence. Feed presence counts hosts from approved sources only; certificate presence comes from the public logs described on the Certificates tab; DNS checks cover the apex name and are refreshed on a schedule. Under each address: network (AS) and country come from the public iptoasn.com routing dataset; a reverse-DNS name is what the address's owner published. Neither shows who controls the hostname: shared hosting, CDNs and cloud providers put unrelated names behind one address. Mail (MX, SPF, DMARC) is checked only for spellings observed somewhere; mail records show the domain can send or receive mail; they do not show who operates it. The provider named under the chips is read from the first MX host (a curated list of mailbox, hosting, parking, forwarding and registrar services; otherwise the host itself); “sends via” lists the services the SPF record authorises; the DMARC policy is the published p= tag. A red MX or SPF chip names the IP list an address behind the record is on (the MX host's address, or an SPF ip4 range of the record or of the services it includes), checked at page view against the lists approved for display. Mail providers and sending services are shared, so a listing says nothing about who operates the domain. The last bulk DNS check of every tracked spelling finished 2026-10-19 11:34 UTC (784,714 names).