barclaystc[.]com

PhishDestroy identifies barclaystc.com as a generic phishing domain posing an elevated credential theft threat through a spoofed banking login interface. The domain mimics legitimate banking branding to harvest user credentials and session tokens, likely targeting Barclays customers based on visual and textual cues embedded in the phishing page. No evidence of a custom drainer kit was observed during initial static analysis; instead, the page appears to rely on a generic HTML form that posts harvested data to a remote endpoint for immediate exfiltration. This domain resolves to the IP address 188.114.97.3 and was registered on March 26, 2026 through Metaregistrar BV. Security vendor detection remains low at 1 out of 95 engines on VirusTotal as of the latest analysis cycle. The domain holds a valid SSL certificate issued by Let’s Encrypt, which may enhance its credibility and bypass automated detection mechanisms that do not inspect encrypted traffic. While not currently listed on Google Safe Browsing (GSB), the domain has minimal global blocklist coverage, indicating early-stage deployment with limited exposure to enterprise defenses. Barclaystc.com remains active and constitutes an elevated risk to users who may encounter it via phishing emails, malvertising, or typo-squatted links. Immediate action includes blocking the domain at DNS and network levels, flagging the associated IP and SSL certificate for inspection, and updating user awareness materials to highlight the specific threat posed by this fraudulent site. Despite low detection and blocklist presence, the combination of recent registration, valid SSL, and active deployment suggests a rapidly evolving threat that requires heightened vigilance and proactive mitigation to prevent credential compromise.