cw950828[.]tw1[.]ru

This domain, cw950828.tw1.ru, is flagged as a high-risk generic phishing threat and remains active as of July 12, 2026. It resolves to IP address 92.53.96.105, hosted on AS9123 by JSC TIMEWEB in Russia, and was registered through TW-Cloud. The page title is 'Crédit Agricole', indicating an attempt to impersonate the French banking brand. Infrastructure analysis reveals the domain uses nameservers ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org, with an SSL certificate issued by GlobalSign nv-sa (GlobalSign GCC R3 DV TLS CA 2020). The HTTP status code is 302, suggesting a redirect mechanism. Security vendor detection is significant: 13 out of 95 engines on VirusTotal flag this domain as malicious. It appears on two blocklists, including PhishDestroy and PhishingDB. Trust assessments are extremely low, with a Scamadviser score of 1/100 and a Gridinsoft score of 0/100. Defenders should block this domain at the network and email gateway levels, monitor for related subdomains or IPs under the same ASN, and investigate the redirect chain for potential landing pages or credential harvesting infrastructure. The exact phishing kit or page content has not been analyzed, but the brand impersonation and low trust scores strongly indicate malicious intent. No further details on the scam type or specific kit are available from the provided intelligence.