Phishing detection: vodafoneelevation.de

Vodafone
https://vodafoneelevation.de/vodafone/ Access site
Screenshot
Screenshot of vodafoneelevation.de
Investigate
Domain vodafoneelevation.de2 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 216.150.1.1
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://vodafoneelevation.de/vodafone/
urlscan Wayback archive.today
Cert YR2
crt.sh Censys Google CT
Phishunt analysis Beta
31 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +4.5 Brand in title
  • +4.1 Brand in screenshot
  • +3.7 Brand in domain label
  • +3.0 OpenPhish
  • +2.0 Young domain
  • +0.8 ASN reputation
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Suspicious TLD
  • +0.4 Long domain
  • +0.3 Free CA
15 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Impersonates Vodafone on a .de domain embedding the brand in its name, hosted on Amazon infrastructure with bulletproof nameservers. Confirmed by OpenPhish. Contains no outbound links to the real Vodafone site, targeting Vodafone account credentials.

OpenPhishBrand in domain labelUnrecognised DNS provider
AI-generated from stored detector signals - the AI never visited the site. · 2026-09-07 · confidence 70%
Domain & Network
Whois
Network
IP 216.150.1.1
Country United StatesUnited States
Hosting Amazon.com, Inc.
ASN AS16509
TLS Cert YR2
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
Network / ASN Amazon.com, Inc.
abuse@amazonaws.com Web form
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-09-07 13:03 UTC  ·  Last refreshed 2026-09-11 15:30 UTC