co515685-wordpress-ixd7o[.]tw1[.]ru

This domain, co515685-wordpress-ixd7o.tw1.ru, is identified as a credential theft operation designed to harvest login credentials by impersonating legitimate WordPress infrastructure. Analysis indicates the domain was crafted to exploit trust in WordPress branding, likely targeting users of the platform through deceptive login portals or fake admin panels. No specific drainer kit signatures were observed, but the infrastructure aligns with known credential harvesting tactics, including the use of privacy errors to mask malicious intent. Technical indicators reveal the domain was registered on February 21, 2026, under an anomalous future date, suggesting potential registrar manipulation or typo-squatting. It resolves to IP address 92.53.96.105, hosted on AS9123 (JSC TIMEWEB, RU), and is associated with an SSL certificate issued by GlobalSign nv-sa (GlobalSign GCC R3 DV TLS CA 2020). Google Safe Browsing explicitly flags the domain as phishing, while VirusTotal reports 12 out of 95 security vendors detecting malicious activity. The domain appears on two independent security blocklists, including PhishDestroy and PhishingDB, further corroborating its malicious classification. As of the latest assessment, co515685-wordpress-ixd7o.tw1.ru has been taken offline, likely due to hosting provider intervention or registrar suspension. However, the infrastructure remains a residual risk, as threat actors may re-deploy the domain or migrate to similarly structured domains (e.g., tw1.ru subdomains). Organizations are advised to block the domain and its resolving IP at the perimeter, monitor for related subdomains, and educate users on identifying credential theft attempts, particularly those leveraging WordPress branding. Network logs should be reviewed for prior connections to 92.53.96.105 or interactions with the domain to assess potential compromise.