staging[.]zpejy[.]app

This investigation documents the infrastructure and detection profile of staging.zpejy.app, which was observed as a banking‑phishing site targeting users of the TikTok platform. The domain was registered on 10 August 2025 through Dynadot LLC and is delegated to the authoritative name servers ns1.dnsip.com and ns2.dnsip.com. DNS resolution points to the single IPv4 address 38.46.13.34, which belongs to AS9294 GNET INC. and is geolocated to Hong Kong.

No TLS certificate was presented during connection attempts, indicating that the site operated without HTTPS protection. VirusTotal analysis recorded 16 detections out of 93 scanning engines, confirming that a notable minority of security products flagged the domain as malicious. The domain appears on one public blocklist and is explicitly listed by the PhishDestroy service, reinforcing its classification as a phishing vector. The page title returned by the server was “TikTok”, matching the declared scam type of banking phishing.

Current monitoring shows the domain is offline, but historical evidence suggests it was actively serving malicious content prior to takedown. Defenders should update domain‑based blocklists with the observed IP address and name‑server pair, enforce TLS inspection policies to capture any future unencrypted traffic to the host, and monitor for new domains registered with the same registrar and similar naming patterns. Continued observation of the AS9294 prefix for anomalous activity is advisable, as is periodic re‑scanning of the domain if it reappears. Attribution to the specific phishing kit cannot be established from the available data, and no further page content has been captured.