65298[.]vip

The domain 65298.vip is identified as a brand-impersonation threat targeting TikTok users. Analysis indicates the domain was designed to mimic TikTok’s login interface, likely to harvest user credentials or distribute malicious payloads. As of the latest verification, the domain has been taken offline, though prior activity suggests it was actively used in phishing campaigns. Infrastructure analysis reveals the domain was registered through Dynadot LLC on September 6, 2025, and resolved to the IP address 38.46.13.34, hosted under AS9294 (GNET INC.) in Hong Kong. The domain appears on one security blocklist and was flagged by 17 of 95 vendors on VirusTotal, indicating a consensus among security tools regarding its malicious nature. No SSL certificate was detected, further reducing its legitimacy and increasing the risk of man-in-the-middle attacks or data interception. Current status confirms the domain is offline, though residual risk remains due to potential reuse of the infrastructure or similar domains. Organizations and users are advised to block the domain and its associated IP (38.46.13.34) at the network level. Individuals who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available. Monitoring for related domains registered under the same registrar or IP range is recommended to preempt further threats.