eyewjb[.]loan

Analysis of the domain eyewjb.loan indicates a high‑risk brand‑impersonation campaign targeting TikTok. The domain was registered on 30 August 2025 through Dynadot LLC and resolves to the IP address 38.46.13.34, which belongs to AS9294 GNET INC. in Hong Kong. No TLS certificate is presented, meaning the site serves only HTTP, which is typical for malicious infrastructure that avoids encryption overhead. The page title returned from the host is “TikTok”, confirming the intent to mimic the legitimate brand.

The site is classified as an investment scam in the intelligence feed. Reputation services show strong consensus of maliciousness: Google Safe Browsing flags the domain for social engineering, PhishDestroy has actively blocked it, and AlienVault OTX lists it in a single threat‑intelligence pulse. The domain appears on one public blocklist, and Gridinsoft assigns a trust score of 0 / 100. VirusTotal reports that 16 of 93 security vendors have flagged the host, reinforcing the suspicion. Nameserver records point to ns1.dnsip.com and ns2.dnsip.com, which are commonly used by disposable or fast‑flux hosting providers.

The current operational status is offline, which may be due to takedown actions or temporary suspension by the hosting provider. Because the infrastructure is still resolvable to the same IP and the domain remains registered, threat actors could reactivate the site or clone the infrastructure under a new domain. Defenders should continue to block the IP 38.46.13.34 at perimeter firewalls, add eyewjb.loan to URL filtering and threat‑intelligence feeds, and monitor for any new domains registered by the same registrar that resolve to the same nameservers or IP range. Regular re‑scans on VirusTotal and periodic checks of Google Safe Browsing are recommended to capture any changes in detection status.