cl469886-wordpress-ipv4q[.]tw1[.]ru

This domain, cl469886-wordpress-ipv4q.tw1.ru, is currently flagged as an active phishing threat targeting users through a WordPress-themed lure. Analysis indicates the domain was registered on February 21, 2026, and resolves to 92.53.96.105, an IP address hosted within AS9123 (JSC TIMEWEB) in Russia. The infrastructure is consistent with a parked domain setup, as evidenced by the page title 'Домен припаркован в Timeweb' and nameservers under Timeweb’s control. However, the inclusion of 'wordpress' in the subdomain suggests an attempt to mimic legitimate WordPress hosting, a common tactic in phishing campaigns to deceive users into believing the site is associated with a trusted platform. Technical indicators reinforce the phishing classification. The domain is blocked by two security blocklists, including PhishDestroy and PhishingDB, and is flagged by Google Safe Browsing for social engineering. Twelve out of ninety-five security vendors on VirusTotal have detected malicious activity associated with this domain, though the specific payload or phishing kit remains unconfirmed. The SSL certificate, issued by GlobalSign, provides basic encryption but does not validate the legitimacy of the site’s content. MX records point to Timeweb’s mail servers, which could be leveraged for credential harvesting or further phishing distribution. Defenders should treat this domain as high-risk due to its active status and confirmed presence on multiple blocklists. The 302 HTTP redirect suggests the domain may be part of a larger redirection chain, potentially leading to a phishing landing page or malware distribution. Organizations should block traffic to and from 92.53.96.105 and monitor for any attempts to exploit the WordPress branding in the subdomain. Given the domain’s recent registration and lack of legitimate content, it is unlikely to serve a benign purpose. Additional scrutiny of Timeweb-hosted domains with similar naming patterns may reveal related threats.