conversemy[.]store

This domain, conversemy.store, is identified as a credential theft operation specifically impersonating TikTok Shop. The site presents a fraudulent login interface designed to harvest user credentials, including usernames, passwords, and potentially payment details. Victims are lured under the pretense of accessing legitimate TikTok Shop services, but any entered information is captured by threat actors for unauthorized account access, financial fraud, or further phishing campaigns. The risk is elevated due to the direct targeting of a widely recognized e-commerce platform with a large user base, increasing the likelihood of successful exploitation. Analysis indicates conversemy.store was registered through Gname.com Pte. Ltd. and is flagged by 17 out of 95 security vendors on VirusTotal, including detections for phishing and malicious activity. The domain resolves to the IP address 104.21.63.51, a hosting provider commonly associated with malicious infrastructure. It has been added to one security blocklist and was previously listed in a threat intelligence pulse on AlienVault OTX. The page title explicitly mimics TikTok Shop, reinforcing its impersonation tactics. Gridinsoft assigns the domain a trust score of 0/100, further confirming its malicious nature. The domain is currently offline, but similar threats may reemerge under different names. If you visited conversemy.store or entered any credentials, immediate action is required. First, change the passwords for any accounts accessed through the site, prioritizing those linked to financial services or personal data. Enable multi-factor authentication (MFA) on all critical accounts to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized transactions or login attempts, and report any anomalies to the platform’s support team. If payment details were entered, contact your financial institution to block or reverse fraudulent charges. Additionally, scan your device for malware using updated security tools to ensure no secondary infections were introduced. Users should remain vigilant for follow-up phishing attempts via email or messaging platforms, as stolen credentials may be used in broader campaigns.