giris[.]onwin2448[.]net

This domain, giris.onwin2448.net, was identified as a brand-impersonation phishing site targeting Barclays customers. Infrastructure analysis reveals the domain was registered on February 21, 2026, through Internet Domain Service BS Corp and used Cloudflare nameservers (anuj.ns.cloudflare.com, summer.ns.cloudflare.com). It resolved to a German-hosted IP address (91.92.240.61) under AS202412, operated by Omegatech LTD. The SSL certificate was issued by Let's Encrypt (R13), a common choice for both legitimate and malicious infrastructure.

The page title, Barclays.Net, directly references the targeted brand, confirming the impersonation intent. At the time of assessment, the domain was offline, and no live content was accessible for further analysis. Detection data shows 22 of 93 security vendors on VirusTotal flagged the domain as malicious, and it appeared on one security blocklist. The registrar and hosting provider details, along with the use of Cloudflare, are consistent with known phishing infrastructure patterns, though these alone do not confirm malicious activity without additional context.

Defenders should treat this domain as a confirmed phishing threat due to the combination of brand impersonation, detection vendor flags, and blocklist presence. While the site is currently offline, monitoring for re-activation or related domains registered through the same registrar or hosting provider is recommended. If historical data or logs indicate user interactions with this domain, affected accounts should be reviewed for potential credential compromise. No additional scam classification (e.g., investment, crypto, or courier fraud) is supported by the available evidence.