Sparkasse
Certificate findings for Sparkasse
DomainSpoof matched these hostnames, from public certificate logs, to Sparkasse's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.
Published now · 15 findings, grouped by hostname
- sparkasse-spreeneisse.de NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…2 addressesPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
DetailsHide details for sparkasse-spreeneisse.de
- Hostname
- sparkasse-spreeneisse.de
- First seen
- 2026-11-05 09:07 UTC
- DNS
- Resolves · checked 2026-11-05 09:07 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 212.7.194.71.
- Phishing-host list fetched with the address
- Resolved to 212.7.194.71
- Brand
- Sparkasse
- Addresses
- 212.7.194.71 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.212.7.194.53 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
- Domain
- sparkasse-spreeneisse.de
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:41 UTC
- sparkasse-mm-li-mn.de US · AS46475 · Limestone Networks, Inc.2 addressesPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
DetailsHide details for sparkasse-mm-li-mn.de
- Hostname
- sparkasse-mm-li-mn.de
- First seen
- 2026-11-05 09:04 UTC
- DNS
- Resolves · checked 2026-11-05 09:04 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.54.
- Phishing-host list fetched with the address
- Resolved to 69.162.80.54
- Brand
- Sparkasse
- Addresses
- 69.162.80.54 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.212.7.194.67 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
- Domain
- sparkasse-mm-li-mn.de
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:41 UTC
- sparkasse-meisen.de US · AS46475 · Limestone Networks, Inc.2 addressesPhishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missing
DetailsHide details for sparkasse-meisen.de
- Hostname
- sparkasse-meisen.de
- First seen
- 2026-11-05 09:01 UTC
- First published
- 2026-10-28 05:36 UTC
- DNS
- Resolves · checked 2026-11-05 09:01 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 69.162.80.52.
- Phishing-host list fetched with the address
- Resolved to 69.162.80.52
- Brand
- Sparkasse
- Addresses
- 69.162.80.52 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.69.162.80.55 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
- Domain
- sparkasse-meisen.de
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:54 UTC
- mailing.sparkasse-bayreuth.de DE · AS58010 · UVENSYS uvensys GmbHReportedUnder sparkasse-bayreuth.de, reported by PhishDestroyMX presentSPF -allDMARC reject
DetailsHide details for mailing.sparkasse-bayreuth.de
- Hostname
- mailing.sparkasse-bayreuth.de
- First seen
- 2026-11-03 14:11 UTC
- First published
- 2026-11-03 14:30 UTC
- Listing
- PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
- DNS
- Resolves · checked 2026-11-04 14:33 UTC
- Reported
- PhishDestroy, listing sparkasse-bayreuth.de and the names under it
- Observed in the PhishDestroy feed
- Certificate logged in CT
- We matched its certificate name
- Latest DNS check
- Certificate
- Issued by YR1Valid 2026-11-03 13:07 UTC to 2027-02-01 13:07 UTCLogged 2026-11-03 14:06 UTC in Google ParcelYard2027h1, entry 591,464,769SHA-256 469252bf643e4be99de13a54f2d11c689aca8de74f1ade89445c078ab9117b46Public key SHA-256 fbb7eb2b052ef6704f37d3de38f2120f7b7190c9d70c6d66c8a216e0af717997
- PhishDestroy
- Brand
- Sparkasse
- Addresses
- 185.98.186.254 · Germany · AS58010 UVENSYS uvensys GmbH
- Domain
- sparkasse-bayreuth.de
- MX
- Receives mail at d01es.mail.s-web.de, d02es.mail.s-web.de, e01es.mail.s-web.de
- SPF
- SPF record with -all: other senders fail
- DMARC
- DMARC policy p=reject
- Checked
- 2026-11-04 14:34 UTC
- ausbildung-berufe-sparkasse.de DE · AS8560 · IONOS-AS IONOS SEPhishing hostIONOSAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy none
DetailsHide details for ausbildung-berufe-sparkasse.de
- Hostname
- ausbildung-berufe-sparkasse.de
- First seen
- 2026-11-02 04:47 UTC
- First published
- 2026-11-02 05:45 UTC
- DNS
- Resolves · checked 2026-11-05 05:52 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 217.160.0.52.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 217.160.0.52
- Latest DNS check
- Certificate
- Issued by Sectigo Public Server Authentication CA DV R36 · precertificateValid 2026-11-02 00:00 UTC to 2027-05-15 23:59 UTCLogged 2026-11-02 04:41 UTC in IPng Networks Gouda2027h1, entry 290,744,162SHA-256 689df19b75bcdbff4d23672235aa7d7209a61559c88f84ad0f6a2ac6ff19282aPublic key SHA-256 09c83dddf557b08b76ebb36673768418ddcb31e2f216dede32a76876941afe66
- Brand
- Sparkasse
- Addresses
- 217.160.0.52 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
- IONOS
- IONOS (217.160.0.52): shared web hosting and domain registration. One address typically serves many customer sites.
- Domain
- ausbildung-berufe-sparkasse.de
- MX
- Receives mail at mx00.ionos.de, mx01.ionos.de
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- DMARC policy p=none: reports only
- Checked
- 2026-11-05 06:43 UTC
- www.sparkasse-donau-ries.de DE · AS3320 · DTAG Deutsche Telekom AGPhishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
DetailsHide details for www.sparkasse-donau-ries.de
- Hostname
- www.sparkasse-donau-ries.de
- First seen
- 2026-10-29 02:31 UTC
- First published
- 2026-10-29 02:34 UTC
- DNS
- Resolves · checked 2026-11-05 02:42 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 80.150.6.143
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-10-29 01:31 UTC to 2027-01-27 01:31 UTCLogged 2026-10-29 02:30 UTC in Let's Encrypt Sycamore2027h1, entry 830,875,890SHA-256 213b5e1d992a80d9c32b89a762961c666e3acb01dc905fe8b76c2eec8ece715ePublic key SHA-256 cb2ecfca4757ccb8b79ddf708bbc1ca58cc0ccc81faee68ba77067680ea3fa40
- Brand
- Sparkasse
- Addresses
- 80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
- Domain
- sparkasse-donau-ries.de
- MX
- Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 03:54 UTC
- sparkasse-donau-ries.de DE · AS3320 · DTAG Deutsche Telekom AGPhishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
DetailsHide details for sparkasse-donau-ries.de
- Hostname
- sparkasse-donau-ries.de
- First seen
- 2026-10-29 02:31 UTC
- First published
- 2026-10-29 02:34 UTC
- DNS
- Resolves · checked 2026-11-05 02:42 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 80.150.6.143
- Latest DNS check
- Certificate
- Issued by YE1 · precertificateValid 2026-10-29 01:31 UTC to 2027-01-27 01:31 UTCLogged 2026-10-29 02:30 UTC in Let's Encrypt Sycamore2027h1, entry 830,875,890SHA-256 213b5e1d992a80d9c32b89a762961c666e3acb01dc905fe8b76c2eec8ece715ePublic key SHA-256 cb2ecfca4757ccb8b79ddf708bbc1ca58cc0ccc81faee68ba77067680ea3fa40
- Brand
- Sparkasse
- Addresses
- 80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
- Domain
- sparkasse-donau-ries.de
- MX
- Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
- SPF
- SPF record with ~all: other senders soft-fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 03:54 UTC
- beta.sparkassen-chess-trophy.de DE · AS24940 · HETZNER-AS Hetzner Online G…Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX presentSPF ?allDMARC missing
DetailsHide details for beta.sparkassen-chess-trophy.de
- Hostname
- beta.sparkassen-chess-trophy.de
- First seen
- 2026-10-28 21:11 UTC
- First published
- 2026-10-28 21:24 UTC
- DNS
- Resolves · checked 2026-11-04 21:31 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 188.40.28.24.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 188.40.28.24
- Latest DNS check
- Certificate
- Issued by YR1 · precertificateValid 2026-10-28 20:09 UTC to 2027-01-26 20:09 UTCLogged 2026-10-28 21:08 UTC in IPng Networks Gouda2027h1, entry 252,257,078SHA-256 6ef81fc760a5c78ef222dfa6bc7e9abe4fadb990c94b1662dd3b585ec2a15871Public key SHA-256 179b8ab7c1297e72c27ec32a62ccc5e52fabbc5341ddb4fae46a14b3fb116015
- Brand
- Sparkasse
- Addresses
- 188.40.28.24 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
- Hetzner
- Hetzner (188.40.28.24): a cloud provider. It rents servers and addresses to its customers.
- Domain
- sparkassen-chess-trophy.de
- MX
- Receives mail at mail.sparkassen-chess-trophy.de
- SPF
- SPF record with ?all: other senders are neutral
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 23:22 UTC
- www.sparkasse-tan-de.top MD · AS56380 · AS-ITFRUIT ''IT FRUIT'' S.R…Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
DetailsHide details for www.sparkasse-tan-de.top
- Hostname
- www.sparkasse-tan-de.top
- First seen
- 2026-10-28 15:01 UTC
- First published
- 2026-10-28 15:12 UTC
- DNS
- Not resolving since 2026-11-03 · checked 2026-11-04 15:21 UTC
- Checks
- Overdue since 2026-11-03 15:20 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.83.179.201.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 45.83.179.201
- Certificate
- Issued by YR1Valid 2026-10-28 13:59 UTC to 2027-01-26 13:59 UTCLogged 2026-10-28 14:57 UTC in Google ParcelYard2027h1, entry 490,159,030SHA-256 0479bf10c5c746b954f20961eeef440b2cf739a640613ae1d55f7d9a0c41ffa9Public key SHA-256 1a32711e022d1717e9e05cb4f1238c1eabcb90672f1fee8e63d872630e863d3d
- Brand
- Sparkasse
- Addresses
- 45.83.179.201 · Moldova · AS56380 AS-ITFRUIT ''IT FRUIT'' S.R.L.
- Domain
- sparkasse-tan-de.top
- Registered
- 2026-10-28 · PDR Ltd.
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 17:09 UTC
- sparkasse-tan-de.top MD · AS56380 · AS-ITFRUIT ''IT FRUIT'' S.R…Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
DetailsHide details for sparkasse-tan-de.top
- Hostname
- sparkasse-tan-de.top
- First seen
- 2026-10-28 15:01 UTC
- First published
- 2026-10-28 15:12 UTC
- DNS
- Not resolving since 2026-11-03 · checked 2026-11-04 15:21 UTC
- Checks
- Overdue since 2026-11-03 15:20 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.83.179.201.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 45.83.179.201
- Certificate
- Issued by YR1Valid 2026-10-28 13:59 UTC to 2027-01-26 13:59 UTCLogged 2026-10-28 14:57 UTC in Google ParcelYard2027h1, entry 490,159,030SHA-256 0479bf10c5c746b954f20961eeef440b2cf739a640613ae1d55f7d9a0c41ffa9Public key SHA-256 1a32711e022d1717e9e05cb4f1238c1eabcb90672f1fee8e63d872630e863d3d
- Brand
- Sparkasse
- Addresses
- 45.83.179.201 · Moldova · AS56380 AS-ITFRUIT ''IT FRUIT'' S.R.L.
- Domain
- sparkasse-tan-de.top
- Registered
- 2026-10-28 · PDR Ltd.
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 17:09 UTC
- www.sparkasse-s-tan-de.top MD · AS56380 · AS-ITFRUIT ''IT FRUIT'' S.R…Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
DetailsHide details for www.sparkasse-s-tan-de.top
- Hostname
- www.sparkasse-s-tan-de.top
- First seen
- 2026-10-28 11:26 UTC
- First published
- 2026-10-28 11:58 UTC
- DNS
- Not resolving since 2026-11-03 · checked 2026-11-04 12:09 UTC
- Checks
- Overdue since 2026-11-03 12:09 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.83.179.201.
- Certificate logged in CT
- Phishing-host list fetched with the address
- Resolved to 45.83.179.201
- Certificate
- Issued by YR2Valid 2026-10-28 10:25 UTC to 2027-01-26 10:25 UTCLogged 2026-10-28 11:24 UTC in Google PlumbersArms2027h1, entry 488,100,915SHA-256 007b53c908d5d8fac80b9f3aec66644e5d0d7da62f45593407b8303ea654efccPublic key SHA-256 886352cb20ac7fc44ce29d2d45904f322229b93b7a4b81c7ac3787474f281983
- Brand
- Sparkasse
- Addresses
- 45.83.179.201 · Moldova · AS56380 AS-ITFRUIT ''IT FRUIT'' S.R.L.
- Domain
- sparkasse-s-tan-de.top
- Registered
- 2026-10-28 · Openprovider
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 14:35 UTC
- sparkasse-s-tan-de.top MD · AS56380 · AS-ITFRUIT ''IT FRUIT'' S.R…Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 8 d ago
DetailsHide details for sparkasse-s-tan-de.top
- Hostname
- sparkasse-s-tan-de.top
- First seen
- 2026-10-28 11:26 UTC
- First published
- 2026-10-28 11:58 UTC
- DNS
- Not resolving since 2026-11-03 · checked 2026-11-04 12:09 UTC
- Checks
- Overdue since 2026-11-03 12:09 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 45.83.179.201.
- Certificate logged in CT
- Phishing-host list fetched with the address
- Resolved to 45.83.179.201
- Certificate
- Issued by YR2Valid 2026-10-28 10:25 UTC to 2027-01-26 10:25 UTCLogged 2026-10-28 11:24 UTC in Google PlumbersArms2027h1, entry 488,100,915SHA-256 007b53c908d5d8fac80b9f3aec66644e5d0d7da62f45593407b8303ea654efccPublic key SHA-256 886352cb20ac7fc44ce29d2d45904f322229b93b7a4b81c7ac3787474f281983
- Brand
- Sparkasse
- Addresses
- 45.83.179.201 · Moldova · AS56380 AS-ITFRUIT ''IT FRUIT'' S.R.L.
- Domain
- sparkasse-s-tan-de.top
- Registered
- 2026-10-28 · Openprovider
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 14:35 UTC
- sparkasse-id-tan-de.top MD · AS56380 · AS-ITFRUIT ''IT FRUIT'' S.R…ReportedReported by PhishTankMX absentSPF missingDMARC missingRegistered 9 d ago
DetailsHide details for sparkasse-id-tan-de.top
- Hostname
- sparkasse-id-tan-de.top
- First seen
- 2026-10-28 10:18 UTC
- First published
- 2026-10-28 11:02 UTC
- Listing
- PhishTank: first observed in the feed 2026-10-28 · still listed at the last successful feed check 2026-11-05 09:46 UTC
- DNS
- Not resolving since 2026-10-29 · checked 2026-11-05 09:02 UTC
- Reported
- PhishTank
- Observed in the PhishTank feed
- We matched the new listing
- Latest DNS check
- PhishTank
- PhishTank report #9551506
- Brand
- Sparkasse
- Addresses
- 45.83.179.201 · Moldova · AS56380 AS-ITFRUIT ''IT FRUIT'' S.R.L.
- Domain
- sparkasse-id-tan-de.top
- Registered
- 2026-10-27 · PDR Ltd.
- MX
- Publishes no mail exchanger
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-04 16:53 UTC
- news.sparkassen-mehrwertportal.de SE · AS1299 · TWELVE99 Arelion Sweden ABPhishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF missingDMARC missing
DetailsHide details for news.sparkassen-mehrwertportal.de
- Hostname
- news.sparkassen-mehrwertportal.de
- First seen
- 2026-10-28 02:27 UTC
- DNS
- Resolves · checked 2026-11-05 09:05 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.154.150.15.
- Phishing-host list fetched with the address
- Certificate logged in CT
- Resolved to 185.154.150.15
- Latest DNS check
- Certificate
- Issued by YR1 · precertificateValid 2026-10-28 01:25 UTC to 2027-01-26 01:25 UTCLogged 2026-10-28 02:23 UTC in DigiCert Wyvern2027h1, entry 328,010,255SHA-256 314a66699a9f1c30d14ba788ebdbc88a0756e1ae6da258001d7cfe435e76dcc4Public key SHA-256 3618886e8a273f6c7e3f88baa577e366637492b7e45d525cdf882652053738f0
- Brand
- Sparkasse
- Addresses
- 185.154.150.15 · Sweden · AS1299 TWELVE99 Arelion Sweden AB
- Domain
- sparkassen-mehrwertportal.de
- MX
- Receives mail at mx00.udag.de, mx01.udag.de
- SPF
- Publishes no SPF record
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:41 UTC
- sparkasse-altersvorsorgedepot.de DE · AS24940 · HETZNER-AS Hetzner Online G…Phishing hostHetznerAddress hosted confirmed phishing in the last 48 hMX absentSPF -allDMARC missing
DetailsHide details for sparkasse-altersvorsorgedepot.de
- Hostname
- sparkasse-altersvorsorgedepot.de
- First seen
- 2026-10-26 13:07 UTC
- DNS
- Resolves · checked 2026-11-05 09:02 UTC
- Phishing host
- A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 144.76.59.138.
- Phishing-host list fetched with the address
- Resolved to 144.76.59.138
- Latest DNS check
- Certificate
- Logged in Google PlumbersArms2027h1, entry 455,461,311SHA-256 8740a1aba63386159ec18f5cdd348d6d5d2e7c8bc909f80ed230214280f331f3
- Brand
- Sparkasse
- Addresses
- 144.76.59.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
- Hetzner
- Hetzner (144.76.59.138): a cloud provider. It rents servers and addresses to its customers.
- Domain
- sparkasse-altersvorsorgedepot.de
- MX
- Publishes no mail exchanger
- SPF
- SPF record with -all: other senders fail
- DMARC
- Publishes no DMARC policy
- Checked
- 2026-11-05 08:23 UTC
How certificate findings are selected
Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.
DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Sparkasse when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

