ELSTER

Tax authorities Germanyelster.deRank 207 of the most impersonated
Cert findings · 24 h
1
Cert findings · 7 days
11
2 reported or listed · 9 on phishing hosts
Registered lookalikes
71
4 listed by a source or an address list
Official domains
6
verified from ELSTER's own sites and records

Certificate findings for ELSTER

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to ELSTER's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 16 findings, grouped by hostname

  1. wwwelster.de NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    wwwelster.de
    First seen
    2026-11-05 09:05 UTC
    DNS
    Resolves · checked 2026-11-05 09:05 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.7.194.68.
    1. Phishing-host list fetched with the address
    2. Resolved to 212.7.194.68
    Brand
    ELSTER
    Addresses
    212.7.194.68 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    69.162.80.58 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Domain
    wwwelster.de
    MX
    Receives mail at mail.h-email.net
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:41 UTC

    Suggest a correction

  2. www.fuchsjagd-herzberg-elster.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.fuchsjagd-herzberg-elster.de
    First seen
    2026-11-04 01:37 UTC
    First published
    2026-11-04 01:54 UTC
    DNS
    Resolves · checked 2026-11-05 02:07 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 00:32 UTC to 2027-02-02 00:32 UTC
    Logged 2026-11-04 01:31 UTC in Let's Encrypt Sycamore2027h1, entry 932,368,510
    SHA-256 894679e47d6bcc43a7cbeea0723891dd417675d365fb0f4396cc9d20187f5eb2
    Public key SHA-256 44fccca39c09f2f034bcb46fb15ba195fd3407a7fea17b3f30761c4700b2831a
    Brand
    ELSTER
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    fuchsjagd-herzberg-elster.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:54 UTC

    Suggest a correction

  3. fuchsjagd-herzberg-elster.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    fuchsjagd-herzberg-elster.de
    First seen
    2026-11-04 01:36 UTC
    First published
    2026-11-04 01:54 UTC
    DNS
    Resolves · checked 2026-11-05 02:07 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-11-04 00:32 UTC to 2027-02-02 00:32 UTC
    Logged 2026-11-04 01:31 UTC in Let's Encrypt Sycamore2027h1, entry 932,368,510
    SHA-256 894679e47d6bcc43a7cbeea0723891dd417675d365fb0f4396cc9d20187f5eb2
    Public key SHA-256 44fccca39c09f2f034bcb46fb15ba195fd3407a7fea17b3f30761c4700b2831a
    Brand
    ELSTER
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    fuchsjagd-herzberg-elster.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:54 UTC

    Suggest a correction

  4. elster.daten-verifizierung.com SE · AS30893 · NOACKHOSTING-AS No ACK Grou…
    ListedUnder daten-verifizierung.com, listed by MetaMaskMX absentSPF missingDMARC missingRegistered 34 d ago
    DetailsHide
    Hostname
    elster.daten-verifizierung.com
    First seen
    2026-11-01 23:36 UTC
    First published
    2026-11-01 23:56 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 00:06 UTC
    Listed
    MetaMask, listing daten-verifizierung.com and the names under it
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-01 22:35 UTC to 2027-01-30 22:35 UTC
    Logged 2026-11-01 23:33 UTC in IPng Networks Halloumi2027h1, entry 333,584,984
    SHA-256 a7c164aa7f44dca27acd048d56e3c8c6f58d6671724d82c1334f5fdc8d17b269
    Public key SHA-256 544fd7aff1eb9a7e72835fbd26fdf0486f65d6da951c9181eac217c128b284b8
    Brand
    ELSTER
    Addresses
    150.40.98.37 · Sweden · AS30893 NOACKHOSTING-AS No ACK Group Holding AB
    Domain
    daten-verifizierung.com
    Registered
    2026-10-02 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:33 UTC

    Suggest a correction

  5. www.landrat-elbe-elster.de DE · AS8560 · IONOS-AS IONOS SE
    Phishing hostIONOSAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC reject
    DetailsHide
    Hostname
    www.landrat-elbe-elster.de
    First seen
    2026-11-01 04:21 UTC
    First published
    2026-11-01 05:03 UTC
    DNS
    Resolves · checked 2026-11-05 05:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 217.160.0.150.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 217.160.0.150
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV R36 · precertificate
    Valid 2026-11-01 00:00 UTC to 2027-05-18 23:59 UTC
    Logged 2026-11-01 04:15 UTC in DigiCert Sphinx2027h1, entry 326,701,236
    SHA-256 10af30b049a3802a3bd3fc8a7a8f7ac73fad9203c0190278166594a07fad01e8
    Public key SHA-256 83687b25753ac1a8261a45ee2c0fc82d12d1f1ee418e5fd4078ef1a53937dfd3
    Brand
    ELSTER
    Addresses
    217.160.0.150 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (217.160.0.150): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    landrat-elbe-elster.de
    MX
    Receives mail at smtpin.rzone.de
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  6. landrat-elbe-elster.de DE · AS8560 · IONOS-AS IONOS SE
    Phishing hostIONOSAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC reject
    DetailsHide
    Hostname
    landrat-elbe-elster.de
    First seen
    2026-11-01 04:21 UTC
    First published
    2026-11-01 05:03 UTC
    DNS
    Resolves · checked 2026-11-05 05:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 217.160.0.150.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 217.160.0.150
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV R36 · precertificate
    Valid 2026-11-01 00:00 UTC to 2027-05-18 23:59 UTC
    Logged 2026-11-01 04:15 UTC in DigiCert Sphinx2027h1, entry 326,701,236
    SHA-256 10af30b049a3802a3bd3fc8a7a8f7ac73fad9203c0190278166594a07fad01e8
    Public key SHA-256 83687b25753ac1a8261a45ee2c0fc82d12d1f1ee418e5fd4078ef1a53937dfd3
    Brand
    ELSTER
    Addresses
    217.160.0.150 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (217.160.0.150): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    landrat-elbe-elster.de
    MX
    Receives mail at smtpin.rzone.de
    SPF
    Publishes no SPF record
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  7. www.elbe-elster-tours.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.elbe-elster-tours.de
    First seen
    2026-10-31 03:52 UTC
    First published
    2026-10-31 04:02 UTC
    DNS
    Resolves · checked 2026-11-05 04:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-31 02:47 UTC to 2027-01-29 02:47 UTC
    Logged 2026-10-31 03:46 UTC in IPng Networks Gouda2027h1, entry 275,308,075
    SHA-256 c79ddf154a6b22933d229ebd634860c57083544d13922e3378a34154f49ec3c1
    Public key SHA-256 c7024fd83bc2f948cbae670588ebf4bf9e31227ce908eac15ae47233e72c63ba
    Brand
    ELSTER
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    elbe-elster-tours.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  8. elbe-elster-tours.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    elbe-elster-tours.de
    First seen
    2026-10-31 03:52 UTC
    First published
    2026-10-31 04:02 UTC
    DNS
    Resolves · checked 2026-11-05 04:06 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-31 02:47 UTC to 2027-01-29 02:47 UTC
    Logged 2026-10-31 03:46 UTC in IPng Networks Gouda2027h1, entry 275,308,075
    SHA-256 c79ddf154a6b22933d229ebd634860c57083544d13922e3378a34154f49ec3c1
    Public key SHA-256 c7024fd83bc2f948cbae670588ebf4bf9e31227ce908eac15ae47233e72c63ba
    Brand
    ELSTER
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    elbe-elster-tours.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 06:43 UTC

    Suggest a correction

  9. elster.pages.dev US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishTank
    DetailsHide
    Hostname
    elster.pages.dev
    First seen
    2026-10-30 16:21 UTC
    First published
    2026-10-30 17:03 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-04 17:12 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-10-30 15:15 UTC to 2027-01-28 16:14 UTC
    Logged 2026-10-30 16:15 UTC in Let's Encrypt Sycamore2027h1, entry 858,207,163
    SHA-256 a1b6775dcc79ee8a0a47d1e2234dd1296dda24f79911bab1f95fba370b17595b
    Public key SHA-256 16a98143c9b60c4f7c756e7cb65db271d9408ecb5ed806d61797e9ea3e5ddb00
    PhishTank
    PhishTank report #8513574
    Brand
    ELSTER
    Addresses
    172.66.44.103 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.47.153 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:310c::ac42:2c67
    2606:4700:310c::ac42:2f99
    Cloudflare
    Cloudflare (172.66.44.103, 172.66.47.153): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.

    Suggest a correction

  10. www.elster-3e.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.elster-3e.de
    First seen
    2026-10-30 07:41 UTC
    First published
    2026-10-30 08:40 UTC
    DNS
    Resolves · checked 2026-11-05 08:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-30 06:36 UTC to 2027-01-28 06:36 UTC
    Logged 2026-10-30 07:35 UTC in Google ParcelYard2027h1, entry 518,916,914
    SHA-256 8a99d0440c3caebe1ee5bdc03d1e9a05a7bd5f84b2d6f371a8090592d9529378
    Public key SHA-256 7ea7c212232e676574de28b5e3799d4fcc5228e37468b3aac25caf4642c0cb04
    Brand
    ELSTER
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    elster-3e.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  11. elster-3e.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    elster-3e.de
    First seen
    2026-10-30 07:41 UTC
    First published
    2026-10-30 08:40 UTC
    DNS
    Resolves · checked 2026-11-05 08:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-30 06:36 UTC to 2027-01-28 06:36 UTC
    Logged 2026-10-30 07:35 UTC in Google ParcelYard2027h1, entry 518,916,914
    SHA-256 8a99d0440c3caebe1ee5bdc03d1e9a05a7bd5f84b2d6f371a8090592d9529378
    Public key SHA-256 7ea7c212232e676574de28b5e3799d4fcc5228e37468b3aac25caf4642c0cb04
    Brand
    ELSTER
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    elster-3e.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  12. www.elster-finanzamt.info SC · AS209101 · ipvendettainc IP Vendetta I…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 42 d ago
    DetailsHide
    Hostname
    www.elster-finanzamt.info
    First seen
    2026-10-29 01:42 UTC
    First published
    2026-10-29 02:34 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.95.156.162.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.95.156.162
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 00:40 UTC to 2027-01-27 00:40 UTC
    Logged 2026-10-29 01:38 UTC in IPng Networks Halloumi2027h1, entry 295,373,343
    SHA-256 bff4391bf6fcb3bf67f6c54421091e689172f030834b9ac3fa80e5928431e178
    Public key SHA-256 fb74b3b7758dbdd3c8edd824ed60010e30209e114289cd3b54a35b4e9cbe3a90
    Brand
    ELSTER
    Addresses
    185.95.156.162 · Seychelles · AS209101 ipvendettainc IP Vendetta Inc.
    Domain
    elster-finanzamt.info
    Registered
    2026-09-24 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  13. webmail.elster-finanzamt.info SC · AS209101 · ipvendettainc IP Vendetta I…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 42 d ago
    DetailsHide
    Hostname
    webmail.elster-finanzamt.info
    First seen
    2026-10-29 01:42 UTC
    First published
    2026-10-29 02:34 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.95.156.162.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.95.156.162
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 00:40 UTC to 2027-01-27 00:40 UTC
    Logged 2026-10-29 01:38 UTC in IPng Networks Halloumi2027h1, entry 295,373,343
    SHA-256 bff4391bf6fcb3bf67f6c54421091e689172f030834b9ac3fa80e5928431e178
    Public key SHA-256 fb74b3b7758dbdd3c8edd824ed60010e30209e114289cd3b54a35b4e9cbe3a90
    Brand
    ELSTER
    Addresses
    185.95.156.162 · Seychelles · AS209101 ipvendettainc IP Vendetta Inc.
    Domain
    elster-finanzamt.info
    Registered
    2026-09-24 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  14. mail.elster-finanzamt.info SC · AS209101 · ipvendettainc IP Vendetta I…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 42 d ago
    DetailsHide
    Hostname
    mail.elster-finanzamt.info
    First seen
    2026-10-29 01:42 UTC
    First published
    2026-10-29 02:34 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.95.156.162.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.95.156.162
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 00:40 UTC to 2027-01-27 00:40 UTC
    Logged 2026-10-29 01:38 UTC in IPng Networks Halloumi2027h1, entry 295,373,343
    SHA-256 bff4391bf6fcb3bf67f6c54421091e689172f030834b9ac3fa80e5928431e178
    Public key SHA-256 fb74b3b7758dbdd3c8edd824ed60010e30209e114289cd3b54a35b4e9cbe3a90
    Brand
    ELSTER
    Addresses
    185.95.156.162 · Seychelles · AS209101 ipvendettainc IP Vendetta Inc.
    Domain
    elster-finanzamt.info
    Registered
    2026-09-24 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  15. elster-finanzamt.info SC · AS209101 · ipvendettainc IP Vendetta I…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 42 d ago
    DetailsHide
    Hostname
    elster-finanzamt.info
    First seen
    2026-10-29 01:42 UTC
    First published
    2026-10-29 02:34 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.95.156.162.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.95.156.162
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 00:40 UTC to 2027-01-27 00:40 UTC
    Logged 2026-10-29 01:38 UTC in IPng Networks Halloumi2027h1, entry 295,373,343
    SHA-256 bff4391bf6fcb3bf67f6c54421091e689172f030834b9ac3fa80e5928431e178
    Public key SHA-256 fb74b3b7758dbdd3c8edd824ed60010e30209e114289cd3b54a35b4e9cbe3a90
    Brand
    ELSTER
    Addresses
    185.95.156.162 · Seychelles · AS209101 ipvendettainc IP Vendetta Inc.
    Domain
    elster-finanzamt.info
    Registered
    2026-09-24 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  16. admin.elster-finanzamt.info SC · AS209101 · ipvendettainc IP Vendetta I…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 42 d ago
    DetailsHide
    Hostname
    admin.elster-finanzamt.info
    First seen
    2026-10-29 01:41 UTC
    First published
    2026-10-29 02:34 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.95.156.162.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.95.156.162
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-29 00:40 UTC to 2027-01-27 00:40 UTC
    Logged 2026-10-29 01:38 UTC in IPng Networks Halloumi2027h1, entry 295,373,343
    SHA-256 bff4391bf6fcb3bf67f6c54421091e689172f030834b9ac3fa80e5928431e178
    Public key SHA-256 fb74b3b7758dbdd3c8edd824ed60010e30209e114289cd3b54a35b4e9cbe3a90
    Brand
    ELSTER
    Addresses
    185.95.156.162 · Seychelles · AS209101 ipvendettainc IP Vendetta Inc.
    Domain
    elster-finanzamt.info
    Registered
    2026-09-24 · Sav.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches ELSTER when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Tax authorities

All brands →