1-acessando2025[.]dns[.]army

On July 23, 2026, the domain 1-acessando2025.dns.army was observed in an elevated-risk brand-impersonation campaign targeting Google. The site resolved to the Amazon Web Services host 18.217.55.60, which is registered to AS16509 (Amazon.com, Inc.) and geolocated to the United States. The domain was created on 18 November 2016 through the INWX GmbH registrar and currently uses the dynv6.com name server set (ns1, ns2, ns3). No TLS certificate was presented, indicating that the site operated over plain HTTP when it was active.

A single page title was recorded: “Banco Bradesco | Desafie o Futuro”, which does not reference the advertised Google brand, suggesting that the content may have been altered or that the page was not fully captured before takedown. Reputation services rated the domain extremely low: Scamadviser assigned a trust score of 1 / 100, Gridinsoft reported 0 / 100, and twelve of ninety‑five VirusTotal scanners flagged the host as malicious. The domain appears on one external blocklist and has been explicitly blocked by the PhishDestroy filtering service. The site is currently offline, but the underlying infrastructure—AWS IP address and dynv6 DNS—remains reusable for future campaigns.

Because the domain leverages a reputable cloud provider and a generic DNS service, threat actors can rapidly spin up similar pointers. Defenders should add 18.217.55.60 to network-level deny lists, monitor DNS queries for the dynv6 name servers, and enforce strict brand-based URL filtering for Google-related traffic. Continuous scanning of newly registered domains that reuse the same registrar or name‑server pattern is recommended. Until the site is confirmed inactive, security teams should treat any traffic to this host as malicious and block it at the perimeter.