cy931251-wordpress-5gmjb[.]tw1[.]ru

PhishDestroy has identified cy931251-wordpress-5gmjb.tw1.ru as a high-risk brand impersonation threat specifically targeting WordPress. This domain was designed to deceive users into believing they were interacting with the legitimate WordPress platform, potentially leading to credential theft or malware installation. No specific drainer kit was identified in association with this domain.

Technical indicators paint a clear picture of malicious intent. VirusTotal analysis shows 13 out of 95 security vendors flagging this domain as malicious. The domain was registered through TIMEWEB-RU and resolves to IP address 92.53.96.105, with a creation date of June 29, 2006. Google Safe Browsing currently flags the domain for phishing, and it appears on 2 security blocklists. The SSL certificate was issued by GlobalSign nv-sa / GlobalSign GCC R3 DV TLS CA 2020, which does not indicate legitimacy for this context.

The domain is currently offline, indicating that response actions have been taken to mitigate the threat. Users who may have visited the site or entered credentials should change their passwords immediately and monitor accounts for suspicious activity. While the immediate risk is reduced, the domain could potentially be reactivated or similar threats may emerge. PhishDestroy recommends ongoing vigilance and the use of security tools to block known malicious domains.