login[.]832576[.]app

On July 23, 2026, the domain login.832576.app was catalogued as a credential‑phishing operation that impersonates the TikTok brand. The HTTP response contains a page title of “TikTok”, directly matching the declared brand target, and the site is classified under the scam type “Credential Phishing”. Registration records indicate the domain was created through Dynadot LLC, and the authoritative name servers are ns1.dnsip.com and ns2.dnsip.com. DNS queries resolve the name to the IPv4 address 38.46.13.34, which is announced by AS9294 GNET INC.

in Hong Kong. No TLS certificate was observed, confirming that the service was delivered over unencrypted HTTP. Threat‑intelligence aggregators provide concrete detections: sixteen of ninety‑three VirusTotal scanners flagged the domain as malicious, and Gridinsoft assigned a trust score of zero out of one hundred. The domain is listed on one external security blocklist and is actively blocked by the PhishDestroy mitigation service.

The combination of brand impersonation, a zero‑trust score, multiple vendor detections, and the absence of encryption elevates the risk to an “elevated” level. Defensive recommendations include denying DNS resolution for login.832576.app at the resolver level, sinkholing or firewall‑blocking outbound traffic to 38.46.13.34, and adding the domain to internal URL filtering and web‑proxy denial lists. Continuous monitoring of the associated IP range and of new registrations under the same registrar should be instituted to detect any reuse of the infrastructure. Although the site is currently taken offline, the observed indicators suggest that the operators may attempt to relaunch the service, so incident response teams should also search for any credentials that could have been harvested while the domain was active.