login[.]273659[.]app

This domain, login.273659.app, is flagged as a brand impersonation phishing page targeting TikTok users. Analysis of the page title, "TikTok," confirms the attempt to mimic the legitimate platform, likely to harvest credentials or distribute malicious payloads. No crypto drainer kit signatures were observed, but the domain’s structure and content align with credential theft campaigns commonly deployed against social media platforms.

Infrastructure analysis reveals the domain was registered on September 09, 2025, through Dynadot LLC, a registrar frequently associated with phishing infrastructure. It resolves to the IP address 38.46.13.34, hosted under AS9294 (GNET INC.) in Hong Kong. VirusTotal detection metrics show 17 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, though Google Safe Browsing (GSB) data is not currently available for this indicator. The SSL certificate is issued by Let’s Encrypt (R12), a common choice for both legitimate and malicious sites due to its accessibility.

As of the latest assessment, login.273659.app has been taken offline, reducing immediate exposure risk. However, the infrastructure remains a latent threat, as domains registered through the same registrar or hosted on the identified IP may reappear in future campaigns. Organizations and users are advised to monitor for similar domains using the seed pattern "273659" or registrations under Dynadot LLC with recent creation dates. Blocking the IP 38.46.13.34 at the network level may mitigate residual risk from associated infrastructure.