ck286359-wordpress-1467a[.]tw1[.]ru

The domain ck286359-wordpress-1467a.tw1.ru has been identified as a generic phishing site. It is currently not associated with any specific brand impersonation or crypto drainer kit, but its purpose is to deceive users into providing sensitive information. The domain was created on February 21, 2026, and has been flagged by multiple security vendors and blocklists, indicating a significant threat level.

Analysis indicates that the domain is flagged by 12 out of 95 security vendors on VirusTotal, suggesting a relatively high detection rate. The domain is registered with Timeweb and resolves to the IP address 92.53.96.105, which is located in Russia and belongs to the autonomous system AS9123 JSC "TIMEWEB". The domain was created on February 21, 2026, and is currently listed as a phishing site by Google Safe Browsing. It also appears on 2 known security blocklists, further confirming its malicious nature.

The domain is currently offline, which may indicate that it has been taken down by the hosting provider or the registrar. However, the infrastructure remains a concern, and it is recommended that security teams continue to monitor the domain for any signs of reactivation. The use of a reputable SSL certificate from GlobalSign could have been an attempt to appear more legitimate to potential victims. Organizations should ensure that their users are trained to recognize phishing tactics and report any suspicious activity to the IT department.