dpwhw[.]sbs

This domain, dpwhw.sbs, is identified as a brand impersonation threat specifically targeting TikTok users. The site mimics the official TikTok platform, presenting an identical page title (TikTok) to deceive visitors into entering credentials or other sensitive information. Such impersonation attacks are commonly used to harvest login details, propagate malware, or facilitate financial fraud, particularly in campaigns targeting social media users who may not scrutinize domain authenticity closely.

Analysis indicates the domain was registered on August 11, 2025, through Dynadot LLC, a registrar frequently associated with malicious infrastructure. It resolves to the IP address 38.46.13.34, located in Hong Kong under AS9294 (GNET INC.), a network with a history of hosting phishing and fraudulent domains. The domain appears on one security blocklist and is flagged by 18 out of 95 security vendors on VirusTotal, reflecting elevated detection rates. Notably, the domain lacks an SSL certificate, a red flag for users accustomed to secure connections on legitimate platforms.

Users who visited dpwhw.sbs should immediately revoke any credentials entered on the site, particularly TikTok login details. Monitor accounts for unauthorized activity, such as unauthorized posts, messages, or linked third-party applications. If financial or payment information was submitted, contact the relevant institution to secure accounts and review transactions. Additionally, scan devices for malware, as phishing sites often redirect to exploit kits or malicious downloads. Report the domain to security teams or threat intelligence platforms to aid in broader mitigation efforts.