cf179609-wordpress-rd2y2[.]tw1[.]ru

The domain cf179609-wordpress-rd2y2.tw1.ru is currently active and has been classified as a brand‑impersonation site targeting WordPress users. Registration data shows the domain was created on 29 June 2006 and is hosted by TIMEWEB‑RU, using the nameservers ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. DNS resolution points to IP 92.53.96.105, which belongs to AS9123 JSC TIMEWEB in Russia. An HTTPS certificate issued by GlobalSign (GlobalSign GCC R3 DV TLS CA 2020) is present, but the HTTP response is a 302 redirect to a parked page titled "Домен припаркован в Timeweb". Reputation metrics are extremely low: Gridinsoft assigns a trust score of 0 / 100, Scamadviser rates the site 1 / 100, and 13 of 95 VirusTotal scanners have flagged the domain. It appears on two security blocklists and is specifically listed by PhishDestroy and PhishingDB. While the exact content of the site beyond the parked page has not been publicly captured, the combination of a low trust rating, multiple detections, and explicit blocklist listings suggests a high likelihood of malicious intent aimed at deceiving WordPress users. Defenders should block DNS resolution to 92.53.96.105, monitor outbound connections for any attempts to contact this domain, and include the domain in URL filtering policies. Continuous re‑assessment is advised in case the site evolves beyond its current parked state.