Phishing detection: vodafone-business-berlin.store

Vodafone
https://vodafone-business-berlin.store Access site
Screenshot
Screenshot of vodafone-business-berlin.store
Investigate
Domain vodafone-business-berlin.store2 CT hosts on apex
urlscan page.domain VirusTotal Whois

See every phishunt record for this domain

IP 212.227.172.253
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://vodafone-business-berlin.store
urlscan Wayback archive.today
Cert Sectigo Public Server Authentication CA DV R36
crt.sh Censys Google CT
Phishunt analysis Beta
34 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +4.5 Brand in title
  • +4.1 Brand in screenshot
  • +4.1 Site cluster
  • +3.7 Brand in domain label
  • +3.2 Brand favicon
  • +3.0 OpenPhish
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.7 Brand in cert SAN
  • +0.7 Unrecognised DNS provider
  • +0.7 Suspicious TLD
  • +0.6 Long domain
  • +0.6 Registrar reputation
  • +0.2 Hyphens
  • +0.1 External scripts
19 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

A .store domain combining the Vodafone name with business and Berlin terms impersonates the telecom brand. It is listed by OpenPhish, has no CSP or HSTS headers, and is hosted at IONOS, likely targeting account credentials.

Brand in domain labelOpenPhishBrand in title
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-16 · confidence 70%
Domain & Network
Whois
Registrar InterNetX GmbH
Network
IP 212.227.172.253
Country GermanyGermany
Hosting IONOS SE
ASN AS8560
TLS Cert Sectigo Public Server Authentication CA DV R36
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Campaign
This detection belongs to possible campaign 023610f30c62 (3 domains · 3 hosts)
Related infrastructure Betasuspected links from shared infrastructure, not attribution
vodafone-business-berlin.de 60 similar text same ASN similar name appeared together (24h) same rare cert issuer same favicon same screenshot
active 2026-10-16
vodafone-business-berlin.com 60 similar text same ASN similar name appeared together (24h) same rare cert issuer same favicon same screenshot
active 2026-10-17
Top 2 of 2 related · rebuilt daily · corr-1.4.0 · related infrastructure API
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-16 13:12 UTC  ·  Last refreshed 2026-10-18 05:30 UTC