tkmall98[.]vip

This domain is flagged as a brand impersonation phishing site with an elevated risk level. Analysis indicates it specifically targets users of the 'across' platform, presenting itself as a legitimate e-commerce portal under the page title 'TK-Store | buy, sell and discover on TK.' The intent is to deceive victims into entering sensitive credentials or financial information, leveraging social engineering tactics to exploit trust in the impersonated brand. Infrastructure analysis reveals the domain was registered on May 26, 2025, through Global Domain Group LLC. It resolves to the IP address 134.122.166.179, hosted under AS152194 (CTG Server Limited) in Japan. The domain appears on 2 security blocklists and is currently offline. Its SSL certificate is issued by Google Trust Services (WE1). VirusTotal detection shows 18 out of 95 security vendors flagging the domain as malicious, with PhishDestroy and PhishingDB among the sources confirming its phishing classification. Mitigation steps for this threat type include immediate blacklisting of the domain and its associated IP (134.122.166.179) across all network security controls. Organizations should deploy indicators of compromise (IOCs) such as the domain, IP, and SSL certificate issuer details into SIEM systems for retrospective analysis. End-user awareness training should emphasize the risks of brand impersonation, particularly for domains mimicking e-commerce platforms. Monitoring for similar domains registered through Global Domain Group LLC or hosted on the same ASN (AS152194) may help identify related threats. Given the domain's current offline status, continuous monitoring for reactivation or migration to new infrastructure is recommended.