onwin-girisleri[.]net

The domain onwin-girisleri.net has been identified as a brand impersonation threat specifically targeting Barclays, a financial services institution. This domain was operational as a phishing site designed to deceive users into disclosing sensitive credentials or financial information under the guise of legitimate Barclays services. As of the latest assessment, the domain has been taken offline, though prior activity and infrastructure analysis confirm its malicious intent. Analysis of onwin-girisleri.net reveals it was flagged by 22 of 95 security vendors on VirusTotal, indicating broad detection of its phishing-related activity. The domain was registered through Internet Domain Service BS Corp. on August 25, 2025, and resolved to the IP address 91.92.240.61, hosted under AS202412 (Omegatech LTD) in Germany. It appears on one security blocklist and was previously blocked by network-level protections. The SSL certificate was issued by Let's Encrypt (R13), a common tactic among threat actors to mimic legitimacy. The page title, 'Sorry, the website has been stopped,' suggests recent takedown or disruption of its phishing operations. Current status indicates the domain is offline, though the infrastructure remains a potential vector for future malicious activity. Organizations and users are advised to block the domain and its associated IP (91.92.240.61) at the network perimeter. Financial institutions should monitor for related impersonation attempts and educate users on recognizing phishing indicators, such as unexpected domain names or SSL certificates from non-corporate issuers. Continuous monitoring of newly registered domains with similar naming patterns (e.g., 'girisleri') is recommended to preempt further brand impersonation threats.