cb631943-wordpress-stst1[.]tw1[.]ru

PhishDestroy identifies the domain cb631943-wordpress-stst1.tw1.ru as a high-risk brand impersonation phishing attack targeting WordPress users. This domain was designed to trick visitors into entering their credentials on a fraudulent login page, posing as a legitimate WordPress site. Currently, the domain is offline, but users should remain vigilant as similar threats may reappear.

Security analysis reveals that this domain is flagged by 17 out of 95 VirusTotal security vendors, indicating widespread detection. It was registered through TIMEWEB-RU and created on June 29, 2006, with a current IP address of 92.53.96.141. The domain appears on 2 security blocklists and its SSL certificate is issued by GlobalSign nv-sa, which does not prevent its use for phishing. Google Safe Browsing has flagged the domain as phishing, and the page title displayed was "Домен припаркован в Timeweb," a Russian parking page that may have hosted malicious content.

With the domain now taken offline, users who encountered it should change their WordPress passwords immediately and enable two-factor authentication. PhishDestroy recommends always verifying URLs before entering credentials, especially for login pages. To stay protected, users should bookmark official WordPress URLs and use trusted security tools to scan for threats. If you suspect your credentials were compromised, report the incident to relevant authorities and monitor your accounts for unusual activity.