tiketok[.]cc

This domain, tiketok.cc, is actively engaged in brand impersonation targeting TikTok, a widely recognized social media platform. Analysis confirms the domain is currently operational, presenting itself as a fraudulent storefront under the page title 'TKA Shop.' The intent appears to be deceptive engagement with users, likely aiming to harvest credentials, distribute malware, or facilitate financial fraud under the guise of the legitimate TikTok brand. Infrastructure analysis reveals multiple technical indicators corroborating malicious activity. The domain is flagged by 10 of 95 security vendors on VirusTotal, indicating broad detection across threat intelligence platforms. It was registered on July 07, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. The domain resolves to the IP address 52.184.98.194, hosted on infrastructure utilizing Nginx and Vue.js, technologies commonly employed in both legitimate and malicious web applications. The SSL certificate is issued by Let's Encrypt, a certificate authority often exploited by threat actors to lend superficial legitimacy to phishing sites. Additionally, the domain appears in one AlienVault OTX threat intelligence pulse, further confirming its association with known malicious campaigns. Current status indicates the domain remains active and unresolved, posing an ongoing risk to users and organizations. The combination of brand impersonation, recent registration, low detection but persistent blocklist presence, and use of legitimate-looking technologies elevates the risk level to high. Organizations and individuals are advised to implement immediate blocking of the domain and its associated IP address at the network perimeter. Endpoint protection solutions should be updated to recognize and prevent access to this domain. Users encountering this site should avoid interaction, particularly entering credentials or downloading files. Security teams are encouraged to monitor for related domains registered through the same registrar or resolving to the same IP range, as these may represent additional nodes in the same threat actor’s infrastructure.