tk-h5[.]spys1010[.]vip

This domain, tk-h5.spys101.vip, is identified as a high-risk phishing infrastructure impersonating TikTok's Order Center. Analysis indicates the site was designed to mimic legitimate TikTok commerce or order management portals, likely to harvest user credentials, payment details, or other sensitive information under false pretenses. The use of a branded page title, 'TikTok Order Center,' suggests a targeted approach to deceive users expecting official TikTok communications or transactional interfaces. No specific drainer kit signatures were observed in initial scans, but the domain aligns with broader credential phishing tactics observed in e-commerce and social media fraud campaigns. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 38.55.97.60, hosted under AS932 (XNNET LLC) in Hong Kong. It was registered on July 02, 2024, through NameSilo, LLC, a registrar frequently leveraged for short-lived phishing domains due to its accessibility and low-cost registration options. VirusTotal detections show 23 out of 95 security vendors flagging the domain as malicious, with Google Safe Browsing explicitly classifying it as phishing. The domain appears on at least one security blocklist, further corroborating its malicious intent. The combination of recent registration, hosting in a high-risk autonomous system, and low detection rates among some vendors suggests an attempt to evade automated defenses during early deployment. As of the latest verification, tk-h5.spys101.vip has been taken offline, likely in response to detection and reporting by security vendors or hosting providers. However, the remaining risk persists due to the potential for the threat actors to redeploy the infrastructure under a new domain or IP address. Users who interacted with the site should assume credential exposure and take immediate remediation steps, including password resets for TikTok and associated accounts, monitoring for unauthorized transactions, and enabling multi-factor authentication where available. Organizations are advised to block the domain and IP at the network level, and to review logs for any prior connections to the infrastructure. Continuous monitoring of newly registered domains with similar naming patterns or hosting characteristics is recommended to preemptively identify related threats.