cy166976-wordpress-fdffe[.]tw1[.]ru

The domain cy166976-wordpress-fdffe.tw1.ru is currently active and classified as a high‑risk brand‑impersonation campaign targeting WordPress. Infrastructure analysis shows the domain is hosted on an IPv6 address 2a03:6f00:1::5c35:6069 associated with AS9123 JSC TIMEWEB in Russia and uses the Timeweb name servers (ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org). Registration was performed through TW‑Cloud, and the site presents a valid GlobalSign GCC R3 DV TLS certificate. HTTP responses return a 302 redirect, and the page title reported is simply "WordPress". The domain is listed on two security blocklists (PhishDestroy, PhishingDB) and Google Safe Browsing flags it for social engineering. Independent reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). VirusTotal scans indicate 12 of 95 security vendors flag the domain, reinforcing the malicious assessment. While the exact content of the landing page has not been publicly disclosed, the convergence of blocklist inclusion, low trust scores, and multiple vendor detections provides strong evidence of phishing intent. Defenders should add the domain and its resolved IPv6 address to block lists, monitor for related DNS queries, and consider sinkholing the host to disrupt traffic. Ongoing observation is advised to detect any evolution of the payload or additional infrastructure components.