cp075770-wordpress-iqju1[.]tw1[.]ru

The domain cp075770-wordpress-iqju1.tw1.ru is flagged as an active high‑risk brand‑impersonation site targeting the WordPress brand. Infrastructure analysis shows the domain resolves to IP 92.53.96.105, a server located in Russia and associated with AS9123 JSC TIMEWEB. Authoritative nameservers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org, confirming the use of the TIMEWEB hosting platform. The site presents a TLS certificate issued by GlobalSign nv‑sa (GlobalSign GCC R3 DV TLS CA 2020) and returns an HTTP 302 redirect, with the landing page title displaying "Домен припаркован в Timeweb" (Domain parked in Timeweb). Reputation services highlight severe risk: Scamadviser assigns a trust score of 1/100, Gridinsoft 0/100, and Google Safe Browsing flags the domain for SOCIAL_ENGINEERING. VirusTotal reports detections from 11 of 95 security vendors, and the domain appears on two security blocklists, being listed by PhishDestroy and PhishingDB. While the exact malicious content has not been captured, the combination of a parked‑domain page, redirection behavior, and multiple safety‑engine alerts strongly suggests a phishing or credential‑harvesting operation masquerading as a legitimate WordPress resource. Defenders should block the domain at network perimeters, add the IP address to reputation‑based deny lists, and monitor DNS queries for the associated nameservers. Continuous re‑assessment is advised, as further payloads or landing pages may be deployed behind the observed redirect.