tmalldesf[.]top

This domain, tmalldesf.top, represents an elevated-risk brand impersonation phishing campaign targeting users of the TikTokMall platform. Analysis of the domain reveals it mimics the official TikTokMall interface, presenting a page titled 'TikTokMall | buy, sell and discover on TK' to deceive visitors into believing they are interacting with a legitimate marketplace. The objective appears to be credential harvesting or financial fraud, leveraging the trust associated with the TikTokMall brand to extract sensitive information or payments from unsuspecting users.

Technical indicators confirm the malicious nature of this domain. As of the latest assessment, 17 out of 95 security vendors on VirusTotal have flagged tmalldesf.top as malicious, while it also appears on one security blocklist. The domain was registered on December 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 108.187.37.233, hosted under AS138995 (Antbox Networks Limited) in Hong Kong, an autonomous system with a history of hosting phishing infrastructure. Notably, the domain lacks an SSL certificate, further reducing its legitimacy and increasing the likelihood of interception or manipulation of user data.

Users who visited tmalldesf.top should take immediate remedial actions to mitigate potential risks. If any credentials or financial information were entered on the site, those details should be considered compromised and changed immediately across all platforms where they were reused. Affected users are advised to monitor their accounts for unauthorized transactions or suspicious activity and enable multi-factor authentication where available. Additionally, devices used to access the domain should be scanned for malware, as phishing sites may deploy secondary payloads. Organizations should update their security blocklists to include tmalldesf.top and its associated IP address to prevent further exposure.