cj106932-wordpress-urg2s[.]tw1[.]ru

This domain, cj106932-wordpress-urg2s.tw1.ru, is currently active and hosts a brand‑impersonation campaign targeting WordPress. Infrastructure analysis reveals that the domain resolves to IP 92.53.96.105, which belongs to ASN 9123 (JSC TIMEWEB) and is geolocated in Russia. The domain was registered through the TW‑Cloud registrar, and its authoritative name servers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org. TLS termination is provided by a GlobalSign nv‑sa certificate chained to the GlobalSign GCC R3 DV TLS CA 2020, indicating a valid‑looking HTTPS service. An HTTP request to the site returns a 302 redirect, and the page title reported by scanners is “WordPress”, matching the declared brand target.

Reputation services have listed the domain on two blocklists, specifically PhishDestroy and PhishingDB, and Google Safe Browsing flags it for SOCIAL_ENGINEERING. VirusTotal scans show that 13 out of 95 security vendors have flagged the domain as malicious. The Gridinsoft trust score is 0 / 100, reinforcing the classification as high‑risk. The overall risk level is marked as high, and the campaign status remains active.

Analysis indicates that the observable indicators—IP address, ASN, SSL certificate, redirect behavior, and multiple vendor detections—strongly support the presence of a WordPress brand‑impersonation operation. No public content analysis is available, so the exact phishing page structure and credential‑harvesting mechanisms remain unknown. Defenders should block the domain and its resolving IP at network perimeter devices, update URL filtering lists with the identified blocklist entries, and monitor for any traffic to the associated nameservers. Continuous re‑evaluation is advised, as additional detections may emerge from further sandbox or endpoint analysis.