ct201209-wordpress-c4kau[.]tw1[.]ru

The domain ct201209-wordpress-c4kau.tw1.ru is currently active and hosted on IP 92.53.96.105, which resolves to a server in Russia operated by JSC TIMEWEB (ASN 9123). The domain was registered through TW-Cloud and uses Timeweb’s name servers (ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org). TLS negotiation presents a GlobalSign nv‑sa certificate issued by GlobalSign GCC R3 DV TLS CA 2020, indicating a valid SSL chain but offering no indication of legitimate ownership. HTTP requests receive a 302 redirect and the page title reports “Домен припаркован в Timeweb”, a generic parked‑domain notice, with no content related to WordPress. Google Safe Browsing classifies the site under the SOCIAL_ENGINEERING category, and VirusTotal records 13 of 95 security vendors flagging the domain as malicious. Independent trust scores are extremely low (Gridinsoft 0/100, Scamadviser 1/100). The domain appears on two public blocklists (PhishDestroy, PhishingDB) and is labeled as an impersonation of the WordPress brand. While the exact payload or credential‑harvesting mechanism has not been observed, the combination of a parked page, high‑risk classification, and multiple detections suggests the domain is being used to lure WordPress users or to host malicious content. Defenders should block network traffic to 92.53.96.105, add the domain to URL filtering policies, and monitor for any related DNS queries. Continuous re‑evaluation is advised, as the site may evolve to serve active phishing pages or malware.