cc777218-wordpress-242dz[.]tw1[.]ru

Analysis indicates that the fully qualified domain cc777218-wordpress-242dz.tw1.ru was registered on 29 June 2006 via the TIMEWEB‑RU registrar and is hosted on infrastructure owned by JSC TIMEWEB (ASN 9123) in Russia. The domain resolves to 92.53.96.105 and uses four Timeweb nameservers (ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org). A TLS certificate issued by GlobalSign (GlobalSign GCC R3 DV TLS CA 2020) is present, but the HTTP response is a 302 redirect to a page whose title reads “Домен припаркован в Timeweb”, indicating a parked domain rather than active content. Despite the parked status, Google Safe Browsing classifies the site under SOCIAL_ENGINEERING and multiple phishing blocklists (PhishDestroy, PhishingDB) have listed it. The Gridinsoft trust score is 0/100, and VirusTotal reports 13 of 95 scanners flagging the host. The intelligence tags the activity as brand impersonation targeting WordPress, suggesting the domain may be used to lure victims by mimicking WordPress‑related services. At present, no definitive payload or credential‑capture page has been observed, leaving the exact attack vector uncertain. Defenders should block any outbound connections to 92.53.96.105, add the domain to URL filtering policies, and monitor for traffic that attempts to resolve or contact cc777218-wordpress-242dz.tw1.ru. Continuous re‑evaluation is advised because the parked page could be replaced with active phishing content at any time.