guncelgirisleri[.]net

This domain, guncelgirisleri.net, is flagged for brand impersonation targeting Barclays, a major financial institution. The site was designed to mimic legitimate Barclays login portals, tricking users into entering sensitive credentials such as usernames, passwords, and potentially two-factor authentication codes. Such phishing schemes are commonly used to facilitate unauthorized account access, financial fraud, or identity theft. The domain's infrastructure and content were structured to closely resemble Barclays' official branding, increasing the likelihood of successful deception among unsuspecting users. Analysis indicates that guncelgirisleri.net was created on February 21, 2026, and registered through Internet Domain Service BS Corp. At the time of assessment, the domain resolved to the IP address 91.92.240.61, hosted under AS202412 Omegatech LTD in Germany. The domain appears on at least one security blocklist and has been flagged by 21 out of 95 security vendors on VirusTotal, confirming its malicious classification. The SSL certificate, issued by Let's Encrypt (R13), was likely used to lend a false sense of legitimacy to the phishing site. The page title, 'Sorry, the website has been stopped,' suggests the site may have been taken offline either by the threat actor or as a result of enforcement actions. Users who visited guncelgirisleri.net should assume their credentials or personal information may have been compromised. Immediate steps include changing passwords for any accounts accessed or entered on the site, particularly Barclays-related credentials. Enable multi-factor authentication on all financial and sensitive accounts if not already active. Monitor accounts for unauthorized transactions or suspicious activity, and report any anomalies to the affected financial institution. If personal or financial data was entered, consider placing a fraud alert or credit freeze with relevant credit bureaus. Organizations should update their security blocklists to include this domain and its associated IP address to prevent future access attempts.