tiktok-6hy9[.]buzz

Analysis of tiktok-6hy9.buzz indicates that the domain was registered through NameSilo, LLC on February 22, 2025 and is currently taken offline. The site presented the page title “TK-Store | buy, sell and discover on TK”, which does not directly reference the targeted brand but the intelligence tags the campaign as a brand‑impersonation effort aimed at the “across” brand. The underlying infrastructure resolves to IP address 134.122.166.183, hosted in Japan under AS152194 (CTG Server Limited). The domain uses Cloudflare authoritative nameservers becky.ns.cloudflare.com and conrad.ns.cloudflare.com, yet no TLS certificate is deployed, leaving the HTTP service unencrypted.

Reputation services show a Gridinsoft trust score of 0 / 100, and the domain appears on one public security blocklist. It has been listed in fifteen AlienVault OTX pulses and is actively blocked by the PhishDestroy filter. VirusTotal scans report fifteen of ninety‑three security vendors flagging the domain as malicious. The combination of a recent registration date, lack of SSL, low trust score, and multiple independent detections suggests the domain was employed for social‑media phishing, consistent with the “Social Media Phishing” classification.

Because the site is offline, active traffic cannot be measured, but the historical indicators remain relevant for threat‑intel correlation. Defenders should continue to block the domain and its associated IP address at perimeter and DNS layers, monitor for any re‑registration attempts, and add the observed nameserver pair to watchlists for future Cloudflare‑based impersonation campaigns. Further investigation of the page content, if recovered from archives, would be required to confirm the exact phishing vector and any credential‑capture mechanisms.