cq193158-wordpress-ugsl0[.]tw1[.]ru

This domain, cq193158-wordpress-ugsl0.tw1.ru, is currently active and hosts a page titled “WordPress”. The site presents a HTTP 302 redirect and is secured with a GlobalSign nv‑sa certificate issued by GlobalSign GCC R3 DV TLS CA 2020. DNS resolution points to 92.53.96.105, an address allocated to JSC TIMEWEB (ASN 9123) in Russia. The authoritative name servers are ns1.timeweb.ru, ns2.timeweb.ru, ns3.timeweb.org, and ns4.timeweb.org, all operated by the same provider. Google Safe Browsing has flagged the domain for social engineering, and two independent blocklists (PhishDestroy and PhishingDB) list it as malicious. VirusTotal reports 11 of 95 security vendors flagging the domain, reinforcing the suspicion. Reputation services assign extremely low scores: Gridinsoft 0/100, Scamadviser 1/100. The domain is classified as a brand‑impersonation campaign targeting the WordPress brand. The registration was performed through TW‑Cloud, consistent with the hosting ASN. No additional page content has been publicly disclosed, and the specific phishing payload or credential‑capture mechanisms remain unknown. Defenders should block the domain at network perimeter, add its IP address to deny lists, and monitor for any related traffic to the associated nameservers. Continuous observation of the IP and any newly registered subdomains is recommended, as the infrastructure could be reused for further impersonation attempts.