ci650197-wordpress-z247g[.]tw1[.]ru

The domain ci650197-wordpress-z247g.tw1.ru is classified as a generic_phishing site with a high risk rating and remains active as of July 12, 2026. It uses a GlobalSign nv-sa SSL certificate issued by the GlobalSign GCC R3 DV TLS CA 2020, and its HTTP response is a 302 redirect. The domain was created on June 29, 2006, is registered through TIMEWEB-RU, and resolves to IP address 198.18.2.56. Its authoritative nameservers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. Reputation data is extremely low, with a Scamadviser trust score of 1 / 100 and a Gridinsoft score of 0 / 100. Google Safe Browsing flags it for SOCIAL_ENGINEERING, and it appears on two security blocklists, PhishDestroy and PhishingDB. VirusTotal records indicate that 13 of 95 scanned security vendors flagged the domain. The page title returned matches the domain name. No additional content analysis is available. Given the combined evidence—high‑risk classification, multiple blocklist listings, low trust scores, and multi‑vendor detections—defenders should block the domain at the network perimeter, enforce URL filtering, and monitor DNS queries for the associated IP. Continuous observation of traffic to 198.18.2.56 is recommended, and any internal hosts that have resolved or accessed the domain should be investigated for potential credential compromise or malware infection.