cb773971[.]tw1[.]ru

Analysis of the domain cb773971.tw1.ru indicates active brand impersonation targeting SEI, a classification supported by multiple technical indicators. The domain was registered on June 29, 2006, through TIMEWEB-RU, a registrar frequently associated with compromised or malicious infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 87.249.38.179, located in Russia under AS9123 (JSC TIMEWEB), a network segment previously observed hosting phishing campaigns. The domain's nameservers (ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org) further link it to TIMEWEB's hosting environment, which has been documented in abuse reports for facilitating fraudulent activity. Google Safe Browsing has flagged the domain with the label 'SOCIAL_ENGINEERING,' a designation consistent with phishing or brand impersonation tactics. The page title 'cb773971.tw1.ru/depart.php' suggests the presence of a server-side script, a common feature in credential-harvesting or data-exfiltration schemes. While the exact content of the page remains unanalyzed, the combination of a 302 HTTP redirect, a low Gridinsoft trust score of 0/100, and detection by 15 of 93 security vendors on VirusTotal reinforces the classification of high-risk activity. The domain is currently blocked by PhishDestroy and appears on at least one security blocklist, indicating prior identification as malicious. Defenders should treat this domain as confirmed malicious infrastructure. The SSL certificate issued by GlobalSign nv-sa (GlobalSign GCC R3 DV TLS CA 2020) does not mitigate the risk, as certificates of this type are routinely abused in phishing operations. Network-level blocking of 87.249.38.179 and monitoring for connections to cb773971.tw1.ru are recommended. Given the domain's age and persistent activity, it may be part of a larger, long-running campaign. Further investigation into associated IPs, subdomains, or redirect chains could uncover additional compromised assets.