public company · US

Itaú Unibanco

Itau Unibanco Holding S.A.

Primary official domain
itau.com.br
Reviewed official domains
1 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
1
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
1
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF Invalid record · Mail: Receives mail (2 MX hosts) · checked 2026-10-20 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
itauunibanco
Label aliases
Itaú Unibanco · Itau
Official domains
itau.com.br (all)
Generated spellings
232 tracked · 16 observed somewhere · 216 not observed (all)
Can receive mail
6 spellings and 0 reported domains publish MX records · mail at _dc-mx.cd32af8c0c13.itu.com.br 1 · alt1.us.email.fireeyecloud.com 1 · Google 1 · 3 more (16 spellings and 1 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)

Certificate domains matching this brand

Names identified in certificate logs that match this company or brand. A brand match does not indicate bad intent or malicious activity.

Matching domain groups, 30 days
2
distinct registrable domains with a matching certificate name, by latest CT log time; not attacks
Reviewed official
1
groups on this organization's reviewed official domains, 30 days
Not assessed
1
groups with the brand in the name and no review; no judgement implied
Latest CT observation
2026-10-20 04:19 UTC
log timestamp, not issuance or collection time

Own domains (1)

Certificates on this organization's reviewed official domains. These are not lookalikes.

Matching domain / nameMatched brand / domainMatch typeFirst CT observationLatest CT observationDistinct certificatesRelationshipSource-reported abuseDetails
itau.com.br82 names
itau.com.br
Official domain2026-10-19 04:13 UTC2026-10-20 04:19 UTC141Reviewed officialNo report in sample coverage
iubotarquivoconversas-dev.cloud.itau.com.br
itau.com.brOfficial domain2026-10-20 04:19 UTC2026-10-20 04:19 UTC1Issuer Amazon RSA 2048 M01
iti-atendimento-api-hom.cloud.itau.com.br
itau.com.brOfficial domain2026-10-20 04:05 UTC2026-10-20 04:05 UTC1Issuer Amazon RSA 2048 M04
operacoestes.hom.cloud.itau.com.br
itau.com.brOfficial domain2026-10-20 04:03 UTC2026-10-20 04:03 UTC1Issuer Amazon RSA 2048 M01
79 more names in this group (most recent shown)

Generated spellings

Certificate names on a spelling we generate for this organization (typos, swapped letters, other endings).

Matching domain / nameMatched brand / domainMatch typeFirst CT observationLatest CT observationDistinct certificatesDNSMailRelationshipSource-reported abuseDetails
itau.com36 names
itau.com
Generated spelling2026-10-19 11:58 UTC2026-10-20 01:25 UTC52
Resolves200.196.152.201checked 2026-10-19
MXSPFDMARCmail at post01.itau.com.br · DMARC policy reject · checked 2026-10-19
Not assessedNo report in sample coverage
atendhistorico.api.dev.itau.com
itau.comGenerated spelling2026-10-20 00:19 UTC2026-10-20 01:25 UTC2Issuer Amazon RSA 2048 M04
cessao-credito-venda.api.dev.itau.com
itau.comGenerated spelling2026-10-20 00:16 UTC2026-10-20 01:24 UTC3Issuer Amazon RSA 2048 M04
atendhistorico.api.itau.com
itau.comGenerated spelling2026-10-20 00:16 UTC2026-10-20 01:24 UTC3Issuer Amazon RSA 2048 M01
cessao-credito-venda.api.hom.itau.com
itau.comGenerated spelling2026-10-20 00:16 UTC2026-10-20 01:24 UTC3Issuer Amazon RSA 2048 M04
hubext.api.dev.itau.com
itau.comGenerated spelling2026-10-20 00:15 UTC2026-10-20 01:24 UTC3Issuer Amazon RSA 2048 M04
31 more names in this group (most recent shown)

Collected from public certificate-transparency logs since 2026-10-18; 238,580,890 log entries checked so far. 80 logs are read continuously by our CT resolver from the point it started following them; earlier entries are not covered. Names on an organization's official domains are recorded by the resolver for at most 100 names per registrable domain per day, so official-domain name and certificate counts are lower bounds. Times are CT log timestamps, which differ from certificate validity dates. Certificate counts include precertificates and final certificates as separate artifacts. The "Source-reported abuse" badge appears only when an independent source reported that exact name for this organization; a certificate name match never creates it, and "No report in sample coverage" is not a safety verdict. Lookalike domains first seen in the last 7 days are checked in DNS (addresses, name servers and MX of the registrable domain), except names on switched-off tokens; a domain that resolves or publishes MX also gets a mail check (MX, SPF, DMARC). Most certificate names resolve, because issuing a certificate usually requires it; a resolving domain is not evidence of abuse. Mail records show the domain can send or receive mail; they do not show who operates it. A red MX or SPF chip names the IP list an address behind the record is on (the MX host's address, or an SPF ip4 range of the record or of the services it includes), checked at page view against the lists approved for display. Mail providers and sending services are shared, so a listing says nothing about who operates the domain. How CT works