mcp.amgghvyv.bradesco.support.zaka25.duckdns.org

Bradesco

https://mcp.amgghvyv.bradesco.support.zaka25.duckdns.org Access site

Screenshot

Investigate

Domain mcp.amgghvyv.bradesco.support.zaka25.duckdns.org573 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 147.224.137.194

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://mcp.amgghvyv.bradesco.support.zaka25.duckdns.org

urlscan

Wayback

archive.today

Cert YE1

crt.sh

Censys

Google CT

Phishunt analysis Beta

35 medium suspicion suspiciousheuristic risk score · not a probability

Why?

+6.1 Google Safe Browsing
+5.3 Keyword match
+5.1 Site cluster
+3.4 Shared IP cluster
+2.8 ASN reputation
+2.6 Brand in subdomain
+2.2 Country mismatch
+1.1 No CSP header
+1.1 No HSTS header
+0.9 Young certificate
+0.8 Brand + login token
+0.7 Brand in cert SAN
+0.7 Unrecognised DNS provider
+0.6 Long domain
+0.6 Deep subdomain
+0.6 Suspicious TLD
+0.3 Free CA

18 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Impersonates Bradesco using a deep subdomain chain on a duckdns.org dynamic DNS domain, with the brand and support wording in the hostname. Flagged by Google Safe Browsing, it likely harvests banking credentials. Hosted on Oracle cloud.

Brand in subdomainDeep subdomainGoogle Safe Browsing

AI-generated from stored detector signals - the AI never visited the site. · 2026-10-25 · confidence 80%

Domain & Network

Whois

Registrar Gandi SAS

Network

IP 147.224.137.194 Oracle Cloud OCI

Country

United States

Hosting Oracle Corporation

ASN AS31898

TLS Cert YE1

External detection Google Safe Browsing

GSB category: SOCIAL_ENGINEERING

CleanOpenPhish · PhishTank · TweetFeed · urlscan.io

Report this phishing

Network / ASN Oracle Corporation

abuse_report@oracle.com

Submit to blocklists

Google Safe Browsing Microsoft SmartScreen APWG PhishTank

Tracked from 2026-10-24 23:23 UTC · Last refreshed 2026-10-25 23:30 UTC

Phishing detection: mcp.amgghvyv.bradesco.support.zaka25.duckdns.org