PhishStats flags atendimentobradescosaude.com phishing site using Bradesco Saude name
PhishStats flagged atendimentobradescosaude.com as a phishing site using the Bradesco Saude name, recorded on IP 185.158.133.1 behind Cloudflare.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 4 November 2026 PhishStats, an automated phishing-tracking service, flagged atendimentobradescosaude.com as a phishing site using the name of Bradesco Saude, the health insurance arm of the Brazilian bank Bradesco. PhishStats recorded the site resolving to the IP address 185.158.133.1, which is announced by Cloudflare (AS13335) and geolocates to Germany. The domain combines the Portuguese word for customer service with the Bradesco Saude brand, a construction built to look like an official support address.
How the scam works
Domains that join a brand name to words such as customer service, support or updates are a standard phishing technique, because they look plausible in a link or an email and exploit trust in the brand. Health-insurance phishing in Brazil is commonly spread by email, SMS or WhatsApp messages that claim a plan needs to be renewed, that a payment failed, or that benefits will be suspended, and that direct the recipient to a lookalike page to confirm their details.
Pages like this typically ask for the login used for the insurer's member portal, personal data such as the CPF tax number, and sometimes card or payment details to settle a supposed overdue amount. The information can be used for account takeover, identity fraud or card fraud. Being behind Cloudflare hides the true hosting location and is common to both legitimate and malicious sites, so it is not proof of anything on its own; here it accompanies a domain that imitates the brand. Bradesco Saude members should reach the insurer only through its official site or app and treat unsolicited renewal or suspension messages with suspicion. Anyone who entered details should change passwords, contact the insurer and watch for misuse of their CPF. The domain and IP come from the PhishStats listing and have not been independently checked by scammers.com.
Source
Listing on PhishStats, an automated phishing-tracking service, 4 November 2026, recording IP 185.158.133.1. Not independently verified by scammers.com.
Red flags
- A support-looking domain that joins customer service wording to the Bradesco Saude brand.
- A domain that is not an official bradesco.com.br or bradescoseguros.com.br address.
- Messages claiming your plan will be suspended unless you confirm details.
- Requests for your CPF, portal login or card details on a linked page.
- Hosting behind a service that hides the real location while imitating a brand.
If you were targeted
- 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
- 2Open the company's official app or type its address yourself to check your account.
- 3If you entered details, change your password at once and contact the company through its official channels.
- 4Report the message and the link to the company and to your national phishing reporting service.
- 5Delete the message without replying or tapping any links.