claim-letssendit[.]fun

This domain, claim-letssendit.fun, is identified as an active brand impersonation threat designed to deceive users into disclosing TikTok account credentials. The site employs social engineering tactics, presenting a fraudulent login interface under the pretext of a promotional or account verification process. Analysis of the page title, 'let's send it,' suggests an attempt to mimic TikTok’s platform-specific language, increasing the likelihood of user engagement through familiarity and urgency. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. The domain resolves to the IP address 104.21.54.167 and is protected by Cloudflare, a common evasion technique to obscure hosting origins. Detection metrics indicate elevated risk: the domain appears on three security blocklists and is flagged by 5 out of 95 security vendors on VirusTotal. Additional protections include HSTS and HTTP/3, which may be leveraged to enhance the site’s perceived legitimacy. Users who visited claim-letssendit.fun should immediately revoke any sessions initiated through the site and reset their TikTok account passwords using a secure, unrelated device. Multi-factor authentication should be enabled if not already active, and account activity should be reviewed for unauthorized access or modifications. Browser data, including cookies and cached credentials, should be cleared to eliminate residual session tokens. If financial or personal data was entered, monitoring for identity theft or unauthorized transactions is recommended. Organizations should update blocklists to include this domain and its associated IP address to prevent further exposure.