symphonious-cucurucho-8d9e38[.]netlify[.]app

symphonious-cucurucho-8d9e38.netlify.app is currently listed as offline with an HTTP 404 response. The site resolves to the IPv6 address 2a05:d014:58f:6200::258, which belongs to Amazon.com, Inc. (AS16509) and geolocates to Germany. Registration was performed through Netlify, and the authoritative nameservers are dns1.p04.nsone.net and dns2.p04.nsone.net. The SSL certificate presented is a DigiCert Global G2 TLS RSA SHA256 2020 CA1 issued by DigiCert Inc., and HSTS is enforced, indicating a typical Netlify deployment.

Threat intelligence indicates that the domain has been observed impersonating a "Tiktok Shop" page, as reflected in the page title. Fourteen of ninety‑five VirusTotal scanners have flagged the domain, and it appears on a single external blocklist. PhishDestroy has also added the domain to its blocklist, confirming its use in phishing campaigns. No public content is reachable due to the 404 status, so the exact phishing payload, credential‑stealing forms, or redirect behavior cannot be confirmed at this time.

Defenders should continue to block the domain at network perimeter and endpoint filters, referencing the IPv6 address and associated ASN. Monitoring of Netlify‑hosted assets for re‑activation is advised, as the infrastructure can be rapidly redeployed. Threat‑intel teams should correlate any future login‑page requests to the "Tiktok Shop" keyword with this host, and consider sharing indicators of compromise with broader communities. Given the current offline state, the risk remains elevated because the same infrastructure could be reused for new campaigns targeting TikTok users.