cy792838[.]tw1[.]ru

This domain, cy792838.tw1.ru, is actively engaged in brand impersonation targeting SEI, a cryptocurrency-related entity. Registered through TIMEWEB-RU on June 29, 2006, the domain resolves to IP address 87.249.38.179, hosted on AS9123 (JSC TIMEWEB) in Russia. Infrastructure analysis reveals nameservers ns1.timeweb.ru and ns2.timeweb.ru, consistent with the registrar's hosting environment. The domain currently returns an HTTP 302 redirect, with the destination path /depart.php visible in the page title, though the exact functionality of this endpoint remains unconfirmed. Security vendor detection is notable, with 17 of 93 engines flagging the domain on VirusTotal. The domain appears on one security blocklist and is explicitly blocked by PhishDestroy. Google Safe Browsing classifies this as social engineering content. The SSL certificate, issued by GlobalSign (GCC R3 DV TLS CA 2020), provides transport encryption but does not validate legitimacy. Gridinsoft assigns a trust score of 0/100, further indicating high-risk classification. Defenders should note the domain's longevity (registered in 2006) does not correlate with legitimacy in this context, as older domains are frequently repurposed for malicious campaigns. The combination of cryptocurrency brand targeting, Russian hosting infrastructure, and active security vendor detections presents a credible threat. Network-level blocking of 87.249.38.179 and the domain itself is recommended. Monitoring for additional subdomains or paths under tw1.ru may reveal related infrastructure. While the exact phishing kit or payload remains unanalyzed, the presence of /depart.php suggests a transaction or credential-harvesting endpoint, common in crypto-related scams. No evidence currently links this domain to broader campaign clusters, but defenders should correlate with other SEI-branded impersonation attempts for pattern recognition.