cf535265-wordpress-00986[.]tw1[.]ru

The domain cf535265-wordpress-00986.tw1.ru has been flagged for impersonating WordPress. At its peak, 13 out of 95 VirusTotal vendors identified it as malicious, and it appeared on two public blocklists, including PhishDestroy and PhishingDB. Google Safe Browsing also flagged the domain, indicating its potential threat level when active.

This domain was hosted on IP 92.53.96.105 in Russia, under the organization JSC TIMEWEB. It was registered through TIMEWEB-RU and used an SSL certificate issued by GlobalSign nv-sa. Despite its creation date in 2006, it was first detected by PhishDestroy as a threat on October 15, 2025, suggesting recent malicious activity. The site has since been taken offline, but during its operation, it posed a risk by mimicking WordPress, potentially targeting users familiar with the platform.

The platform risk score for this domain was 40 out of 100, with an abuse score of 9 out of 100. These metrics indicate a moderate level of threat, considering the impersonation tactics used. The page title, "Домен припаркован в Timeweb," suggests it might have been parked, but the presence of WordPress branding implies a phishing attempt. The domain's offline status now reduces its immediate risk, but its previous activity highlights the need for vigilance against similar threats.