pontos-vantagens[.]dynv6[.]net

On July 23, 2026 analysts observed that the domain pontos-vantagens.dynv6.net was registered on February 21, 2026 and subsequently taken offline. The site resolved to the IPv4 address 54.153.93.204, which is announced by Amazon.com, Inc. (AS16509) and geolocated to the United States. The TLS certificate associated with the host carries the identifier “E7”, indicating a publicly trusted certificate but offering no further provenance. Content analysis revealed the HTML title “Banco Bradesco | Desafie o Futuro”, which does not match the advertised brand target; however, intelligence flags the domain as impersonating Google, suggesting that the underlying payload or phishing lure is intended to deceive users of Google services.

The campaign is classified as a Tech Support Scam in the threat taxonomy. Detection data show that the domain appears on a single security blocklist and is specifically listed by the PhishDestroy blocklist. VirusTotal scanned the host and 12 of 93 anti‑malware engines reported malicious activity, confirming a non‑trivial detection rate. No additional public reputation services or Safe Browsing entries were provided in the available intelligence.

The current offline status limits immediate network‑level mitigation, but defenders should still incorporate the domain, its IP address, and associated ASN into existing blocklists and intrusion‑prevention rules. Monitoring for re‑registration of the same FQDN or for new sub‑domains under the dynv6.net namespace is advised, as threat actors frequently recycle infrastructure. Analysts should also flag any future TLS certificates issued for the same domain, particularly those issued by Amazon‑controlled CAs, as potential indicators of renewed activity. Given the mixed brand signals—Google impersonation coupled with a Brazilian banking page title—incident responders should treat any related alerts as high‑confidence phishing attempts until further context is obtained.