onwin2436[.]net

This domain, onwin2436.net, is identified as a brand impersonation threat specifically targeting Barclays. Analysis confirms the domain was actively used to mimic official Barclays digital properties, likely for credential theft or fraudulent financial transactions. As of the latest verification, the domain has been taken offline, displaying the page title 'Sorry, the website has been stopped.' Infrastructure analysis reveals the domain was registered through Internet Domain Service BS Corp. on February 21, 2026, an unusually future-dated creation timestamp that may indicate registry manipulation or data obfuscation. The domain resolved to the IP address 91.92.240.61, hosted on AS202412 Omegatech LTD in Germany. Security vendors on VirusTotal flagged this domain as malicious, with 20 of 95 engines detecting it. The domain appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt, a common choice for threat actors due to its low-cost and automated issuance process. The elevated risk level is justified by the combination of brand impersonation, suspicious registration details, and confirmed malicious detections. Current status indicates the domain is offline, though residual risk remains due to potential re-activation or migration of the threat infrastructure. Organizations and individuals are advised to block the domain and its associated IP address at the network perimeter. Financial institutions, particularly Barclays customers, should be alerted to this impersonation attempt. Security teams are recommended to monitor for any re-emergence of this domain or similar patterns, including future-dated registrations or domains resolving to the same IP range. End-users should verify the authenticity of any communication purporting to be from Barclays by cross-referencing with official contact channels.