onwin2433[.]net

Analysis of the domain onwin2433.net indicates it was actively impersonating Barclays, a financial institution, as of its last known operational state. The domain resolved to the IP address 91.92.240.61, hosted under AS202412 (Omegatech LTD) in Germany. It was registered on February 21, 2026, through Internet Domain Service BS Corp, a registrar frequently associated with malicious domains. The nameservers, anuj.ns.cloudflare.com and summer.ns.cloudflare.com, suggest Cloudflare was used for DNS management, a common tactic to obscure hosting infrastructure and evade takedowns. The page title, Barclays.Net, explicitly aligns with the reported brand impersonation targeting Barclays.

Detection data from July 2026 shows 22 of 93 security vendors on VirusTotal flagged the domain as malicious, while PhishDestroy and at least one other security blocklist had already classified it as a threat. AlienVault OTX recorded the domain in a single threat intelligence pulse, confirming its inclusion in broader phishing campaigns. The SSL certificate, issued by Let's Encrypt (R13), is consistent with short-lived certificates used in phishing operations to appear legitimate while avoiding long-term scrutiny. As of the report date, the domain is offline, though defenders should treat its infrastructure as compromised.

The combination of a high-risk registrar, Cloudflare DNS, and a hosting provider with a history of abuse warrants continued monitoring. Organizations should block the domain at the DNS and proxy levels, investigate any internal connections to the IP 91.92.240.61, and review logs for interactions with onwin2433.net prior to its takedown. No evidence suggests the domain hosted additional payloads, but the use of Let's Encrypt and Cloudflare infrastructure may indicate an intent to scale similar campaigns. Further analysis of the phishing kit or backend infrastructure is not available at this time.