public company · US

BARCLAYS BANK PLC

Primary official domain: Not yet assessed
Reviewed official domains: 0 (directory review; organization has not verified)
Directory source: BreachScout directory · Suggest a correction

Matching domains, 30 days

registrable domains containing the brand; source date or last feed observation

First source-reported, 30 days

domains first source-reported within 30 days

First observed, 30 days

domains first observed by DomainSpoof in feeds

Email policy (primary domain)

Not checked

No email-policy check yet

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens: barclays
Label aliases: Barclays
Official domains: None recorded (all)
Generated spellings: 109 tracked · 38 observed somewhere · 71 not observed (all)
Can receive mail: 19 spellings and 4 reported domains publish MX records · mail at CSC (corporate registrar) 8 · Google 4 · Above.com parking (parking placeholder) 2 · 9 more (38 spellings and 5 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)

Generated spellings we track

Spellings generated from this organization's official domains and brand tokens (typos, keyboard slips, lure words, look-alike characters, other top-level domains). Each one is checked against phishing feeds, certificate logs and DNS. A spelling that exists is not a finding and not a verdict: it may be unrelated, legitimate or registered defensively.

Tracked spellings

109

generated 2026-10-19; bounded dictionary, not every possible spelling

Seen in a phishing feed

spellings with at least one approved-source feed host on that domain

Seen in certificate logs

spellings with a certificate name on that domain in the logs we collect

Resolves

spellings that answered a DNS query; 109 of 109 checked so far

Can receive mail

spellings with an MX record, of 38 checked · mail at CSC (corporate registrar) 8 · Google 4 · Above.com parking (parking placeholder) 2 · show

Listed mail infrastructure

mail-enabled spellings whose MX host address or SPF sending range is on an IP list approved for display · a fact about shared addresses, not about who operates the spelling

Lure word added 3 tracked · 3 observed

Spelling	Derived from	In phishing feed	In certificate logs	Resolves	Mail	State
supportbarclays[.]com	barclays	Not observed	Not observed	Alive46.30.211.38Parking page · one.com parkingone.com parking (AS51468) · DKdomain-parking.one.comlast answered 2026-10-19	MXSPFDMARCmail at mx1.pub.mailpod11-cph3.one.com · checked 2026-10-19	Observed
barclayssupport[.]com	barclays	Not observed	Not observed	Alive165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed
barclays-update[.]com	barclays	Not observed	Not observed	Alive165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed

Other top-level domain 5 tracked · 5 observed

Spelling	Derived from	In phishing feed	In certificate logs	Resolves	Mail	State
barclays[.]shop	barclays	Not observed	Not observed	Alive109.235.174.5LOOPIA3 (AS41528) · SEing.r101.websupport.selast answered 2026-10-19	MXSPFDMARCmail at mail.barclays.shop · sends via _spf.m101.websupport.se · checked 2026-10-19	Observed
barclays[.]app	barclays	Not observed	Not observed	Alive103.224.182.248Parking page · Trellian / Above.comTrellian / Above.com (AS133618) · AUlb-182-248.above.comlast answered 2026-10-19	MXSPFDMARCmail at Above.com parking (parking placeholder) · checked 2026-10-19	Observed
barclays[.]cc	barclays	Not observed	Not observed	Alive165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed
barclays[.]io	barclays	Not observed	Not observed	Alive165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed
barclays[.]me	barclays	Not observed	Not observed	Alive165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at relay2.netnames.net · DMARC policy reject · checked 2026-10-19	Observed

Look-alike characters (ASCII) 1 tracked · 1 observed

Spelling	Derived from	In phishing feed	In certificate logs	Resolves	Mail	State
barc1ays[.]com	barclays	Not observed	Not observed	Alive66.96.162.128 · Confirmed phishing host address (DomainSpoof, 48 hours)BIZLAND-SD (AS29873) · US128.162.96.66.static.eigbox.netlast answered 2026-10-19	MXSPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARCmail at Google (consumer mailbox) · sends via HostGator · checked 2026-10-19	Observed

Character omitted 3 tracked · 3 observed

Spelling	Derived from	In phishing feed	In certificate logs	Resolves	Mail	State
barlays[.]com	barclays	Not observed	Not observed	Alive217.160.0.100 · Confirmed phishing host address (DomainSpoof, 48 hours)IONOSIONOS (AS8560) · DE217-160-0-100.elastic-ssl.ui-r.comlast answered 2026-10-19	MXSPF · blocklist.de attackers (all services), blocklist.de mail attackersDMARCmail at IONOS (web / mail hosting) · DMARC policy none (monitor only) · sends via IONOS · checked 2026-10-19	Observed
barclay[.]com	barclays	Not observed	Not observed	Alive107.180.46.35GoDaddyGoDaddy (AS26496) · US35.46.180.107.host.secureserver.netlast answered 2026-10-19	MXSPFDMARCmail at Google (consumer mailbox) · DMARC policy reject · sends via Google · checked 2026-10-19	Observed
arclays[.]com	barclays	Not observed	Not observed	Alive103.224.182.239Parking page · Trellian / Above.comTrellian / Above.com (AS133618) · AUlb-182-239.above.comlast answered 2026-10-19	MXSPFDMARCmail at Above.com parking (parking placeholder) · checked 2026-10-19	Observed

Characters swapped 4 tracked · 4 observed

Spelling	Derived from	In phishing feed	In certificate logs	Resolves	Mail	State
barlcays[.]com	barclays	Not observed	Not observed	Alive165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed
barclyas[.]com	barclays	Not observed	Not observed	Alive192.64.119.252NamecheapNamecheap (AS22612) · USlast answered 2026-10-19	MXSPFDMARCmail at Namecheap (web / mail hosting) · sends via Namecheap · checked 2026-10-19	Observed
barcalys[.]com	barclays	Not observed	Not observed	Alive165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed
bacrlays[.]com	barclays	Not observed	Not observed	Alive165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed

Character repeated 2 tracked · 2 observed

Spelling	Derived from	In phishing feed	In certificate logs	Resolves	Mail	State
barclayss[.]com	barclays	Not observed	Not observed	Alive43.250.140.46SYNERGYWHOLESALE-AP SYNERGY WHOLESALE PTY LTD (AS45638) · AUsyn332.syd4.hostyourservices.netlast answered 2026-10-19	MXSPFDMARCmail at Microsoft 365 (consumer mailbox) · DMARC policy quarantine · sends via Microsoft 365, spf.hostyourservices.net · checked 2026-10-19	Observed
barcllays[.]com	barclays	Not observed	Not observed	Alive178.16.54.253 · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)OMEGATECH-AS (AS202412) · SClast answered 2026-10-19	MX · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)SPF · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)DMARCmail at mail.barcllays.com · DMARC policy none (monitor only) · sends via MailBaby, MailChannels · checked 2026-10-19	Observed

Adjacent key typo 1 tracked · 1 observed

Spelling	Derived from	In phishing feed	In certificate logs	Resolves	Mail	State
barclzys[.]com	barclays	Not observed	Not observed	Alive165.160.13.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · US165.160.15.20Parking page · CSC Corporate DomainsCSC Corporate Domains (AS19574) · USlast answered 2026-10-19	MXSPFDMARCmail at CSC (corporate registrar) · checked 2026-10-19	Observed

Last feed and certificate-log check 2026-10-19 05:45 UTC. “Not observed” means none of our checks has seen the spelling; it is not proof the name is unregistered. “Newly registered” means the spelling appeared in a newly-registered-domain list or as a new name in a zone file on that day (sources and terms on the Sources page); it is not a registration date. An observed spelling is not a finding: reported abuse appears only under Reported matches, from independent source evidence. Feed presence counts hosts from approved sources only; certificate presence comes from the public logs described on the Certificates tab; DNS checks cover the apex name and are refreshed on a schedule. Under each address: network (AS) and country come from the public iptoasn.com routing dataset; a reverse-DNS name is what the address's owner published. Neither shows who controls the hostname: shared hosting, CDNs and cloud providers put unrelated names behind one address. Mail (MX, SPF, DMARC) is checked only for spellings observed somewhere; mail records show the domain can send or receive mail; they do not show who operates it. The provider named under the chips is read from the first MX host (a curated list of mailbox, hosting, parking, forwarding and registrar services; otherwise the host itself); “sends via” lists the services the SPF record authorises; the DMARC policy is the published p= tag. A red MX or SPF chip names the IP list an address behind the record is on (the MX host's address, or an SPF ip4 range of the record or of the services it includes), checked at page view against the lists approved for display. Mail providers and sending services are shared, so a listing says nothing about who operates the domain. The last bulk DNS check of every tracked spelling finished 2026-10-19 11:34 UTC (784,714 names).