co589003-wordpress-kt57g[.]tw1[.]ru

The domain co589003-wordpress-kt57g.tw1.ru is actively hosting a site that claims the generic page title "WordPress" and is classified as a brand‑impersonation campaign targeting the WordPress brand. DNS resolution points to 92.53.96.105, an address owned by JSC TIMEWEB (AS9123) located in Russia. The domain uses four Timeweb nameservers (ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, ns4.timeweb.org) and presents a GlobalSign GCC R3 DV TLS certificate, indicating a properly issued SSL chain. HTTP requests receive a 302 redirect, a technique often employed to steer victims toward credential‑harvesting pages. Google Safe Browsing flags the site for social engineering, and two dedicated blocklists—PhishDestroy and PhishingDB—have already listed it as malicious. VirusTotal analysis shows that 13 of 95 scanned security vendors flagged the domain, while reputation services assign it a Gridinsoft trust score of 0/100 and a Scamadviser score of 1/100, reinforcing the high‑risk assessment. The site remains active as of the report date. No direct content analysis is available beyond the page title, so the exact phishing payload or credential‑capture mechanism cannot be confirmed at this time. Defenders should block the domain and its resolving IP at network perimeters, incorporate the domain into URL filtering and threat‑intel feeds, and monitor for any related infrastructure that shares the same nameservers or ASN. Continuous re‑evaluation is advised, as changes to the site’s content or additional detections could alter the threat posture.