Phishing detection: vodafone-business-berlin.com

Vodafone
https://vodafone-business-berlin.com Access site
Screenshot
Screenshot of vodafone-business-berlin.com
Investigate
Domain vodafone-business-berlin.com1 CT host on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 217.160.0.16
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://vodafone-business-berlin.com
urlscan Wayback archive.today
Cert Sectigo Public Server Authentication CA DV R36
crt.sh Censys Google CT
Phishunt analysis Beta
35 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +4.5 Brand in title
  • +4.1 Brand in screenshot
  • +4.1 Site cluster
  • +3.7 Brand in domain label
  • +3.2 Brand favicon
  • +3.0 OpenPhish
  • +1.7 Shared IP cluster
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.6 Long domain
  • +0.6 Final host mismatch
  • +0.6 Registrar reputation
  • +0.2 Hyphens
  • +0.2 Suspicious TLD
21 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Vodafone-branded lookalike domain combining the brand with business and Berlin terms, hosted on IONOS in Germany. The page title uses Vodafone branding while the final host differs, and OpenPhish lists it, suggesting credential theft from business customers.

Brand in domain labelOpenPhishFinal host mismatch
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-17 · confidence 70%
Domain & Network
Whois
Registrar Cronon GmbH
Network
IP 217.160.0.16
Country GermanyGermany
Hosting IONOS SE
ASN AS8560
TLS Cert Sectigo Public Server Authentication CA DV R36
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Campaign
This detection belongs to possible campaign 023610f30c62 (3 domains · 3 hosts)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
vodafone-business-berlin.de 85 similar text same IP same redirect target similar name appeared together (24h) same rare cert issuer same favicon same screenshot
active 2026-10-16
vodafone-business-berlin.store 60 similar text same ASN similar name appeared together (24h) same rare cert issuer same favicon same screenshot
active 2026-10-16
Top 2 of 2 related · rebuilt daily · corr-1.4.0 · related infrastructure API
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-17 13:02 UTC  ·  Last refreshed 2026-10-18 05:30 UTC