Vodafone

Payments & fintech Egyptvodafone.comRank 250 of the most impersonated
Cert findings · 24 h
2
Cert findings · 7 days
3
3 on phishing hosts
Registered lookalikes
214
17 listed by a source or an address list
Official domains
16
verified from Vodafone's own sites and records

Certificate findings for Vodafone

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Vodafone's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 5 findings, grouped by hostname

  1. uct-vodafone.de DE · AS8560 · IONOS-AS IONOS SE
    Phishing hostIONOSAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
    DetailsHide
    Hostname
    uct-vodafone.de
    First seen
    2026-11-05 04:28 UTC
    First published
    2026-11-05 05:17 UTC
    DNS
    Resolves · checked 2026-11-05 05:23 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 217.160.0.18.
    1. Certificate logged in CT
    2. Phishing-host list fetched with the address
    3. Resolved to 217.160.0.18
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-05 03:19 UTC to 2027-02-03 03:19 UTC
    Logged 2026-11-05 04:18 UTC in Google PlumbersArms2027h1, entry 620,069,142
    SHA-256 ac4c5d2de632a6fb2e53539db9b3704439d2abd028b250875481cec0b2e9892f
    Public key SHA-256 340e6a20ec515b36b1ee385575ee9423931ea660163006de2330389fab506b0c
    Brand
    Vodafone
    Addresses
    217.160.0.18 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (217.160.0.18): shared web hosting and domain registration. One address typically serves many customer sites.
    Domain
    uct-vodafone.de
    MX
    Receives mail at mx00.ionos.de, mx01.ionos.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 04:32 UTC

    Suggest a correction

  2. sms-na-vodafone.cz CZ · AS29208 · QUANTCOM-AS Quantcom, a.s.
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 11 y ago
    DetailsHide
    Hostname
    sms-na-vodafone.cz
    First seen
    2026-11-04 23:43 UTC
    First published
    2026-11-05 00:41 UTC
    DNS
    Resolves · checked 2026-11-05 00:49 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 89.235.1.53.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 89.235.1.53
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-04 22:42 UTC to 2027-02-02 22:42 UTC
    Logged 2026-11-04 23:40 UTC in Google PlumbersArms2027h1, entry 616,853,675
    SHA-256 31c5a77aa69bf9806ecbb713933d0bd0c308748906ee31cbdb0fb3f6035706c5
    Public key SHA-256 66ee4a49936b76208f139515b9d5ea26401d331e0c78bd3a22a7abf63896cce6
    Brand
    Vodafone
    Addresses
    89.235.1.53 · Czechia · AS29208 QUANTCOM-AS Quantcom, a.s.
    Domain
    sms-na-vodafone.cz
    Registered
    2015-11-27 · TELE3 s.r.o.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:41 UTC

    Suggest a correction

  3. vodafone-upgrade.com DE · AS24940 · HETZNER-AS Hetzner Online G…
    Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 2 mo ago
    DetailsHide
    Hostname
    vodafone-upgrade.com
    First seen
    2026-11-02 22:22 UTC
    First published
    2026-11-02 23:02 UTC
    DNS
    Resolves · checked 2026-11-04 23:12 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 135.181.161.16.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 135.181.161.16
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-11-02 21:20 UTC to 2027-01-31 21:20 UTC
    Logged 2026-11-02 22:19 UTC in Google PlumbersArms2027h1, entry 579,880,278
    SHA-256 c499f3ad8741ac93c5e4761d280ffe079bbcaa227fbb35598e29e1bbba5a9034
    Public key SHA-256 b3b853913a08a667a4839dd2bed3a2e3f140467c61ab369b10b90a7cdae12dc1
    Brand
    Vodafone
    Addresses
    135.181.161.16 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.161.16): a cloud provider. It rents servers and addresses to its customers.
    Domain
    vodafone-upgrade.com
    Registered
    2026-09-02 · Dominet (HK) Limited
    MX
    Receives mail at vodafone-upgrade.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 23:22 UTC

    Suggest a correction

  4. www.vodafone-badarolsen.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.vodafone-badarolsen.de
    First seen
    2026-10-29 02:16 UTC
    First published
    2026-10-29 02:34 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 01:12 UTC to 2027-01-27 01:12 UTC
    Logged 2026-10-29 02:10 UTC in Geomys Tuscolo2027h1, entry 389,423,888
    SHA-256 2626c7e4f5db035ad4a5db0b00ca30e9c80336ca4b280ef5740cdc2fd609f783
    Public key SHA-256 a701b669b9dbe3eeffef25755c3ed4bd8c4db812e619003cb008326629fe39e3
    Brand
    Vodafone
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    vodafone-badarolsen.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

  5. vodafone-badarolsen.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    vodafone-badarolsen.de
    First seen
    2026-10-29 02:16 UTC
    First published
    2026-10-29 02:34 UTC
    DNS
    Resolves · checked 2026-11-05 02:42 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE1 · precertificate
    Valid 2026-10-29 01:12 UTC to 2027-01-27 01:12 UTC
    Logged 2026-10-29 02:10 UTC in Geomys Tuscolo2027h1, entry 389,423,888
    SHA-256 2626c7e4f5db035ad4a5db0b00ca30e9c80336ca4b280ef5740cdc2fd609f783
    Public key SHA-256 a701b669b9dbe3eeffef25755c3ed4bd8c4db812e619003cb008326629fe39e3
    Brand
    Vodafone
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    vodafone-badarolsen.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:54 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Vodafone when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Payments & fintech

All brands →