Investigating SMS phishing text messages from scratch

This report documents a smishing campaign delivering a Vodafone-branded phishing site that, once opened on a mobile device, walks victims through faux Vodafone account/update pages before redirecting to bank-specific credential phishing pages (targets primarily in Ireland); the author performed OSINT on the domain (registration date, registrar, Cloudflare hosting), attempted takedowns, used URLscan pivots to find related pages, identified a likely Ukrainian phishing host, and published multiple IOCs (phishing URLs).