Phishing detection: vodafone-business-berlin.de

Vodafone
https://vodafone-business-berlin.de Access site
Screenshot
Screenshot of vodafone-business-berlin.de
Investigate
Domain vodafone-business-berlin.de2 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 217.160.0.16
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://vodafone-business-berlin.de
urlscan Wayback archive.today
Cert Sectigo Public Server Authentication CA DV R36
crt.sh Censys Google CT
Phishunt analysis Beta
37 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +4.5 Brand in title
  • +4.1 Brand in screenshot
  • +4.1 Site cluster
  • +3.7 Brand in domain label
  • +3.2 Brand favicon
  • +3.0 OpenPhish
  • +2.0 Young domain
  • +1.7 Shared IP cluster
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Long domain
  • +0.6 Final host mismatch
  • +0.6 Suspicious TLD
  • +0.2 Hyphens
21 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

A German domain combining the Vodafone name with business and Berlin terms impersonates the telecom brand. It is listed by OpenPhish, lacks CSP and HSTS headers, and is hosted at IONOS, likely targeting customer or business account credentials.

Brand in domain labelOpenPhishBrand in title
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-16 · confidence 70%
Domain & Network
Whois
Network
IP 217.160.0.16
Country GermanyGermany
Hosting IONOS SE
ASN AS8560
TLS Cert Sectigo Public Server Authentication CA DV R36
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Campaign
This detection belongs to possible campaign 023610f30c62 (3 domains · 3 hosts)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
vodafone-business-berlin.com 85 similar text same IP same redirect target similar name appeared together (24h) same rare cert issuer same favicon same screenshot
active 2026-10-17
vodafone-business-berlin.store 60 similar text same ASN similar name appeared together (24h) same rare cert issuer same favicon same screenshot
active 2026-10-16
Top 2 of 2 related · rebuilt daily · corr-1.4.0 · related infrastructure API
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-16 13:16 UTC  ·  Last refreshed 2026-10-18 05:30 UTC