sparkassebayreuth[.]com

This domain, sparkassebayreuth.com, is flagged for brand impersonation phishing targeting Apple users. Analysis indicates the site masquerades as a legitimate financial portal, specifically replicating the interface of Sparkasse Bayreuth, a German banking institution. Despite its misleading page title, 'Internet-Filiale - Sparkasse Bayreuth,' the domain is designed to deceive users into divulging Apple-related credentials or financial information, leveraging the trust associated with the impersonated brand.

Technical indicators confirm elevated risk: the domain is registered through Deutsche Telekom AG and was created on April 03, 2008. It resolves to IP address 195.140.52.199, hosted in Germany under AS9099 (Finanz Informatik GmbH & Co. KG). The domain appears on one security blocklist, and VirusTotal reports 17 out of 95 security vendors flagging it as malicious. The SSL certificate is issued by Let's Encrypt (serial number E7), a common tactic to lend false legitimacy to phishing sites. No evidence of a drainer kit was identified, but the infrastructure aligns with credential-harvesting campaigns.

As of the latest assessment, sparkassebayreuth.com has been taken offline, likely due to intervention by security providers or hosting authorities. However, residual risk persists due to the domain's historical use and potential for reactivation. Organizations are advised to monitor for DNS reactivation attempts, block the IP address 195.140.52.199 at the network level, and update endpoint protection rules to include this domain and its associated indicators. Users should be educated on recognizing brand impersonation tactics, particularly those involving financial institutions or trusted technology brands.