Phishing detection: 206.209.210.20

Yahoo
http://206.209.210.20/yahoo/ Access site
Screenshot
Screenshot of 206.209.210.20
Investigate
Domain 206.209.210.20
urlscan page.domain VirusTotal Whois
IP 206.209.210.20
urlscan page.ip VirusTotal ipinfo Greynoise
URL http://206.209.210.20/yahoo/
urlscan Wayback archive.today
Cert -
crt.sh Censys Google CT
Phishunt analysis Beta
33 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +4.5 Brand in title
  • +4.1 Brand in screenshot
  • +3.2 Brand favicon
  • +3.0 PhishTank
  • +3.0 TweetFeed
  • +2.2 Country mismatch
  • +2.0 Young domain
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.6 Brand impersonation in path
  • +0.6 Login text in screenshot
  • +0.6 Suspicious TLD
  • +0.3 Long domain
  • +0.3 Deep subdomain
19 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

Yahoo-themed page served over plain HTTP from a bare IP address on a small German hosting provider, with a form posting to the same origin. Reported on PhishTank, it likely collects Yahoo account credentials.

Brand impersonation in pathPhishTankSame-origin form
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-27 · confidence 82%
Domain & Network
Whois
Network
IP 206.209.210.20
Country GermanyGermany
Hosting Brookplus Limited
ASN AS215674
TLS Cert -
External detection PhishTank TweetFeed
CleanGoogle Safe Browsing · OpenPhish · urlscan.io
Report this phishing
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-27 08:01 UTC  ·  Last refreshed 2026-10-31 11:30 UTC