public company · US
NatWest Group plc
- Primary official domain
- natwestgroup.com
- Reviewed official domains
- 1 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
2
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
2
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 0/10 lookups · Mail: Receives mail (2 MX hosts) · checked 2026-10-20 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- natwest
- Label aliases
- NatWest Group plc · NatWest Bank
- Official domains
- natwestgroup.com (all)
- Generated spellings
- 237 tracked · 37 observed somewhere · 200 not observed (all)
- Can receive mail
- 20 spellings and 1 reported domain publish MX records · mail at Above.com parking (parking placeholder) 8 · mailerhost.net (parking placeholder) 3 · CSC (corporate registrar) 1 · 9 more (37 spellings and 2 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
natwest[.]mobilesterms[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
web[.]natwestaccessfinance[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARC · checked 2026-10-19mail at natwestaccessfinance.com · DMARC policy none (monitor only) · sends via MailBaby | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
2 registrable domains · 2 hostnames · page 1 of 1
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.