cg089651[.]tw1[.]ru

The domain cg089651.tw1.ru has been identified as a generic phishing threat, though no specific brand impersonation was detected. PhishDestroy's analysis indicates that this domain was likely used for credential theft or other fraudulent activities, though no known drainer kit was associated with it. The site's title, "Домен припаркован в Timeweb," suggests it may have been hosted on a parking service, which is a common tactic used by phishers to mask their operations.

Technical indicators for cg089651.tw1.ru provide a clear picture of its threat profile. VirusTotal reports a detection rate of 1 out of 95 security vendors, meaning only one vendor flagged the domain as malicious. The domain was registered on May 25, 2026, and resolves to IP address 92.53.96.132. Its SSL certificate was issued by GlobalSign nv-sa / GlobalSign GCC R3 DV TLS CA 2020, which is a legitimate certificate authority, but this does not guarantee the site's safety. Additionally, the domain appears on two security blocklists, and its Google Safe Browsing status was not explicitly provided but is implied to be potentially unsafe given the threat type.

As of the latest check, cg089651.tw1.ru is offline, indicating that hosting providers or security teams have taken action to disrupt the phishing operation. While the immediate risk is reduced, users should remain vigilant as similar domains may resurface under different names. PhishDestroy recommends avoiding any interaction with this domain, even if it appears active again, and ensuring that security software is up to date to detect such threats. Users who may have entered credentials or personal information on this site should change passwords immediately and monitor accounts for suspicious activity.