tiktokshop[.]c1k[.]cn

tiktokshop.c1k.cn was registered on July 25, 2024 by 北京新网数码信息技术有限公司. The domain resolves to IP 163.53.219.31, which is announced by AS38186 Forewin Telecom Group Limited and geolocated to Hong Kong. The hosting infrastructure uses the nameservers ns1.maff.com and ns2.maff.com, and the site presents a valid TLS certificate issued by Let’s Encrypt (R13). An HTTP request returns status code 200, and the page title reported by intelligence sources is “TikTok-Wholesale”. The campaign is classified as a brand‑impersonation operation targeting Apple, with the underlying scam vector identified as Social Media Phishing.

Detection data shows that 16 of 93 security vendors on VirusTotal have flagged the domain, and it appears on one external blocklist, currently listed by PhishDestroy. The Gridinsoft trust score is 0 out of 100, indicating a high likelihood of malicious intent. The risk rating assigned by the reporting team is high and the domain remains active as of the report date, July 23, 2026. Analysis of the available artifacts suggests that the infrastructure is intentionally obscured through a reputable certificate authority and a generic hosting provider, a pattern consistent with phishing campaigns that aim to gain user trust. The presence of a brand‑impersonation label and the “TikTok‑Wholesale” title indicates an attempt to lure victims through a perceived connection to a popular social media platform, while the underlying target brand is Apple.

No additional forensic details of the landing page content or credential‑capture mechanisms have been disclosed, leaving the precise attack flow uncertain. Defenders should block DNS resolution for tiktokshop.c1k.cn, add the IP address 163.53.219.31 to network‑level deny lists, and ensure that web filtering solutions flag the domain based on its presence on the PhishDestroy blocklist and its VirusTotal detection count.