cx660197-wordpress-dq34v[.]tw1[.]ru

The domain cx660197-wordpress-dq34v.tw1.ru is identified as a high-risk brand impersonation threat targeting WordPress users. Analysis indicates this domain was actively engaged in phishing operations, presenting fraudulent login interfaces to harvest credentials. Currently, the domain is offline, though its infrastructure remains a concern for security teams monitoring similar threats. Infrastructure analysis reveals this domain was flagged by 13 of 95 security vendors on VirusTotal, with Google Safe Browsing explicitly classifying it as phishing. It is registered through TW-Cloud (ASN: 9123) and resolves to the IP address 92.53.96.105, hosted on infrastructure located in Russia (AS9123 JSC TIMEWEB). The domain appears on two security blocklists, including PhishDestroy and PhishingDB. Its SSL certificate is issued by GlobalSign nv-sa, specifically under the GlobalSign GCC R3 DV TLS CA 2020 chain, which is consistent with legitimate but abused hosting environments. At present, cx660197-wordpress-dq34v.tw1.ru is offline, though its prior activity and registration details warrant continued vigilance. Organizations are advised to block the domain and its associated IP (92.53.96.105) at the network perimeter. Security teams should monitor for similar patterns, such as domains combining "wordpress" with randomized strings or Timeweb-hosted infrastructure. End users should verify the legitimacy of any WordPress-related communications or login pages, particularly those hosted on non-official domains.