sparkasse-bayreuth[.]de

The domain sparkasse-bayreuth.de was registered on February 21 2026. Its authoritative name servers are ns2.s-fg-net.com, ns3.s-fg-net.eu, ns4.s-fg-net.de, and ns5.s-fg-net.com. The site resolves to the IPv4 address 195.140.52.199, which is allocated to the German entity Finanz Informatik GmbH & Co. KG under AS9099. The HTTP response is a permanent redirect (301) and the TLS certificate is issued by DigiCert Ireland Limited, using a DigiCert G2 TLS EU RSA4096 SHA384 2022 CA1 chain. Technical fingerprinting indicates the presence of Adobe Experience Manager, Java, React, and HTTP Strict Transport Security (HSTS). The page title reported by the scanner is “Internet-Filiale - Sparkasse Bayreuth”. Although the domain is marketed as a Sparkasse branch, the threat profile lists the impersonated brand as eBay, suggesting a brand‑impersonation campaign that leverages the perceived legitimacy of a financial institution to lure victims. Open‑source intelligence shows the domain appears in a single security blocklist and has been flagged by PhishDestroy. AlienVault OTX contains one pulse referencing the domain. VirusTotal scans returned 0 detections out of 95 engines, and Gridinsoft assigned a trust score of 0 out of 100, indicating that automated scanners have not yet identified malicious payloads but the low trust score reflects the suspicious nature of the infrastructure. Analysts should treat sparkasse-bayreuth.de as an active brand‑impersonation threat. Defensive measures should include adding the domain and its resolving IP address to outbound and inbound block lists, monitoring DNS queries for the listed name servers, and enforcing TLS inspection to verify the certificate chain. Continuous re‑scanning is advised to detect any future payloads or changes in detection ratios.