tok[.]tkzhj[.]com

On July 23, 2026 analysts observed that the domain tok.tkzhj.com is currently offline but retains a set of technical indicators consistent with a brand‑impersonation campaign. VirusTotal records show that 14 of 95 security vendors have flagged the domain, indicating a moderate consensus of malicious behavior. The site presented the page title "TikTok Shop," yet the intelligence classification lists the scam type as Brand Impersonation and the impersonated brand as "base," suggesting that the domain is being used to lure victims under the guise of a legitimate commercial service. No SSL certificate is deployed, meaning all HTTP traffic would be unencrypted if the site were active.

The domain resolves to IP address 118.107.44.21, which is geolocated in Hong Kong and belongs to AS152194 operated by CTG Server Limited. The hosting provider has not been reported as a known malicious infrastructure, but the IP’s association with a single blocklist entry—PhishDestroy—reinforces the suspicion. The domain is registered through Gname.com Pte. Ltd., created on 17 December 2022, and uses the nameservers a7.share-dns.com and b7.share-dns.net, a configuration commonly observed in fast‑flux or disposable hosting patterns. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extreme lack of confidence in the domain’s legitimacy.

The domain appears on one security blocklist, further confirming its malicious reputation. Uncertainty remains regarding the exact content served when the site was live; only the page title is known, and no TLS handshake data or detailed payload analysis is available. Defenders should continue to block tok.tkzhj.com at perimeter firewalls, DNS resolvers, and proxy filters, and consider adding the associated IP 118.107.44.21 to network‑wide deny lists. Monitoring for any re‑registration of the domain or reuse of the IP address is advised, as threat actors may attempt to resurrect the site or shift operations to adjacent infrastructure.