pts-vantagens[.]dynv6[.]net

On July 24 2026 the domain pts-vantagens.dynv6.net was observed as an offline site that was previously used for a Google brand-impersonation campaign. The domain resolves to the IPv4 address 18.217.55.60, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States. Registration data show the name was created on 24 October 2014 and is hosted by Hetzner Online GmbH, with authoritative name servers ns1.dynv6.com, ns2.dynv6.net and ns3.dynv6.net. No TLS certificate was presented when the host was queried, indicating the site operated without HTTPS. The HTTP response returned a page title “Banco Bradesco | Desafie o Futuro”, which does not match the advertised Google impersonation but provides a concrete indicator for content‑based filtering.

The site appeared on a single security blocklist and is listed as blocked by the PhishDestroy service. Analysis by VirusTotal recorded 11 detections out of 95 scanners, and the Gridinsoft trust score was 0 / 100, reinforcing the malicious classification. The threat type is recorded as brand impersonation, with the specific target identified as Google. The elevated risk rating reflects the potential for credential harvesting or other abuse against Google users. Because the site is currently offline, active exploitation is not observable, but the infrastructure—particularly the Amazon‑hosted IP and the Hetzner registration—remains reusable for future campaigns.

Defenders should add the IPv4 address 18.217.55.60 to blocklists, monitor DNS queries for the domain and its name‑server set, and enforce URL filtering that flags any page title containing “Banco Bradesco | Desafie o Futuro”. Continued surveillance of the hosting provider and the registrar may reveal re‑registration attempts. Organizations should educate users about unsolicited Google‑related communications and encourage verification of URLs before credential entry.