onwin2025-giris[.]net

This domain, onwin2025-giris.net, is flagged as a brand impersonation threat specifically targeting Barclays, a major financial institution. Analysis indicates the site was designed to harvest customer credentials through fraudulent login interfaces, a common tactic in credential theft campaigns. No direct evidence of a drainer kit is present in available telemetry, though the infrastructure aligns with known phishing-as-a-service operations. Infrastructure analysis reveals the domain was registered on August 21, 2025, through Internet Domain Service BS Corp, a registrar frequently associated with malicious registrations. It resolved to the IP address 91.92.240.61, hosted under AS202412 (Omegatech LTD) in Germany, a network segment previously linked to phishing and malware distribution. The domain appears on one security blocklist and is detected by 23 out of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious classification. The SSL certificate, issued by Let's Encrypt (R13), follows a pattern observed in short-lived phishing campaigns where certificates are rapidly rotated to evade detection. As of the latest assessment, onwin2025-giris.net has been taken offline, displaying a placeholder page with the title 'Sorry, the website has been stopped.' While the immediate threat is mitigated, residual risk remains for users who may have interacted with the domain prior to its deactivation. Organizations and individuals are advised to monitor for unauthorized access attempts, particularly targeting Barclays customer accounts. Proactive measures include resetting credentials for any accounts accessed during the domain's active period and implementing multi-factor authentication to mitigate the impact of potential credential exposure.