cp994585-wordpress-pptq9[.]tw1[.]ru

The domain cp994585-wordpress-pptq9.tw1.ru is currently active and resolves to the IP address 92.53.96.105, which is hosted in Russia (AS9123 JSC TIMEWEB). Infrastructure analysis shows the domain is registered through TW-Cloud (ASN 9123) and uses four authoritative name servers: ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. The site presents an HTTP 302 redirect and serves a TLS certificate issued by GlobalSign nv-sa under the GlobalSign GCC R3 DV TLS CA 2020 chain. The page title returned is "WordPress," and the threat is classified as brand impersonation targeting the WordPress brand. The domain appears on two security blocklists, PhishDestroy and PhishingDB, and 12 of 95 VirusTotal scanners have flagged it as malicious. Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). Mail exchange is configured with mx1.timeweb.ru (priority 10) and mx2.timeweb.ru (priority 20). While the page content has not been examined, the combination of brand‑impersonation labeling, blocklist presence, and multiple vendor detections indicates a high‑risk phishing infrastructure. Defenders should block the domain and associated IP at perimeter defenses, monitor DNS queries for the listed name servers, and update web‑filter and email‑gateway rules to drop traffic to this host. Continued observation is advised to detect any shift in hosting or additional payload delivery.