tiktokwa[.]shop

The domain tiktokwa.shop was registered on 2025-05-18 and currently resolves to 34.96.193.200, an address owned by Google LLC (ASN 396982) located in Hong Kong. The site presents the page title “TikTok Shop” but lacks an SSL certificate, indicating plain‑HTTP delivery. It is associated with the brand‑impersonation campaign targeting the “base” brand and is classified as a social‑media phishing operation. Threat intel sources record the domain in two AlienVault OTX pulses and on a single security blocklist; it is also listed as blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports that 17 of 95 scanned scanners flagged the domain as malicious.

The domain’s authoritative nameservers are ns3.myhostadmin.net and ns4.myhostadmin.net, and it has been taken offline at the time of this report (23 July 2026). Analysis indicates that the infrastructure leveraged is typical of cloud‑hosted phishing sites, using a reputable cloud provider’s IP range to mask malicious activity. The absence of TLS, combined with a low trust rating and multiple vendor detections, strongly suggests malicious intent despite the legitimate‑looking page title. However, the exact content served (e.g., credential‑capture forms) has not been captured, leaving the specific user‑interaction vector unconfirmed. Defenders should immediately block DNS resolution for tiktokwa.shop and its associated IP 34.96.193.200 at perimeter filters.

Adding the domain to internal blocklists and ensuring that outbound traffic to the hostnames ns3.myhostadmin.net and ns4.myhostadmin.net is denied can prevent further exploitation. Monitoring ASN 396982 for new domains that resolve to the same IP range may reveal additional phishing infrastructure. Continuous feeding of the domain’s indicators into threat‑intelligence platforms (e.g., OTX, PhishDestroy) will aid collective detection.