tikok18appfree[.]xyz

Analysis of the domain tikok18appfree.xyz confirms its classification as an active phishing site targeting TikTok users, as of July 26, 2026. The domain was registered on July 22, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to the IP address 172.86.88.13, with nameservers ns3.my-ndns.com and ns4.my-ndns.com, a configuration commonly observed in phishing campaigns due to its low-cost and ephemeral hosting characteristics. The domain is currently flagged by one security blocklist, specifically PhishDestroy, and has been detected by 3 of 91 security vendors on VirusTotal, indicating emerging but not yet widespread recognition of its malicious nature.

The SSL certificate is issued by Let's Encrypt (YE2), a certificate authority often leveraged by threat actors to lend superficial legitimacy to phishing sites while avoiding cost. The domain remains active, with no evidence of takedown or deactivation at the time of this report. While the exact content of the site has not been analyzed, the domain name—combining 'tikok' (a common misspelling of 'TikTok') with '18appfree'—strongly suggests an attempt to deceive users into believing they are accessing a legitimate TikTok-related application or promotion.

This aligns with the threat type classification of generic phishing, specifically targeting credentials or personal information. Defenders are advised to block the domain at the DNS or network level, monitor for related infrastructure (e.g., the associated IP and nameservers), and alert users to the risk of credential theft. Further investigation into the hosting provider and certificate transparency logs may reveal additional related domains or campaigns.