ch113817[.]tw1[.]ru

This domain is flagged as a generic phishing threat with an elevated risk level, specifically designed for credential harvesting. Analysis indicates the infrastructure was likely repurposed for malicious activity, despite its long-standing registration date, which may have been exploited to lend false legitimacy. Infrastructure analysis reveals the domain ch113817.tw1.ru resolves to the IP address 92.53.96.105, hosted within the Russian autonomous system AS9123 (JSC TIMEWEB). It was registered through TIMEWEB-RU on June 29, 2006, though its current status is offline. The SSL certificate is issued by GlobalSign nv-sa (GlobalSign GCC R3 DV TLS CA 2020), a detail often abused in phishing campaigns to mimic secure connections. The domain appears on two security blocklists and is actively flagged by 11 out of 95 security vendors on VirusTotal, including detections from PhishDestroy and PhishingDB. The parked page title, 'Домен припаркован в Timeweb,' suggests prior benign use, but the domain’s inclusion in threat intelligence feeds confirms its malicious repurposing. Mitigation against this threat involves immediate blocking of the domain and its associated IP (92.53.96.105) at the network perimeter. Organizations should verify that endpoint protection systems have updated signatures to detect and neutralize credential harvesting attempts linked to this infrastructure. Users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window, prioritizing accounts with elevated privileges. Additionally, security teams should monitor for lateral movement or unauthorized access attempts originating from credentials potentially compromised via this phishing campaign.