Phishing detection: zxexxnym.bradesco.support.zaka25.duckdns.org
Bradesco Screenshot
Investigate
Domain
zxexxnym.bradesco.support.zaka25.duckdns.org471 CT hosts on apex
urlscan
VirusTotal
Whois
IP
147.224.137.194
ipinfo
Greynoise
URL
https://zxexxnym.bradesco.support.zaka25.duckdns.org
Phishunt analysis Beta
34
medium suspicion suspiciousheuristic risk score · not a probability
Why?
- +6.1 Google Safe Browsing
- +5.3 Keyword match
- +5.1 Site cluster
- +3.4 Shared IP cluster
- +2.6 Brand in subdomain
- +2.2 Country mismatch
- +1.8 ASN reputation
- +1.1 No CSP header
- +1.1 No HSTS header
- +0.9 Young certificate
- +0.8 Brand + login token
- +0.7 Brand in cert SAN
- +0.7 Unrecognised DNS provider
- +0.6 Long domain
- +0.6 Deep subdomain
- +0.6 Suspicious TLD
- +0.3 Free CA
18 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting
Impersonates Bradesco, the Brazilian bank, with a random subdomain and the brand plus 'support' on a free DuckDNS dynamic DNS domain. Flagged by Google Safe Browsing and hosted on Oracle cloud, it likely harvests banking credentials.
Brand in subdomainBrand + login tokenGoogle Safe Browsing
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-20 · confidence 75%
Domain & Network
Whois
Registrar
Gandi SAS
Network
IP
147.224.137.194 Oracle Cloud OCI
Country
United States
United States
Hosting
Oracle Corporation
ASN
AS31898
TLS Cert
YE2
External detection
Google Safe Browsing
GSB category: SOCIAL_ENGINEERING
CleanOpenPhish · PhishTank · TweetFeed · urlscan.io
Requests
Resources
Observables
Related websites
Report this phishing
Submit to blocklists