aad[.]ttkshop22[.]vip

This domain, aad.ttkshop22.vip, is identified as a high-risk brand impersonation infrastructure targeting Apple users. Analysis indicates the site was designed to harvest Apple ID credentials through a deceptive interface, despite displaying a TikTok-shop page title, which suggests an attempt to obfuscate its true purpose or leverage overlapping e-commerce themes. No drainer kit signatures were observed in available telemetry, though the mismatch between page title and targeted brand raises operational red flags. Infrastructure analysis reveals the domain was registered on November 18, 2025, through Gname.com Pte. Ltd., and resolves to the IP address 118.107.28.226, hosted in Hong Kong under AS152194 (CTG Server Limited). Security telemetry shows 17 out of 95 vendors on VirusTotal flagging the domain as malicious, while Google Safe Browsing classifies it as phishing. The domain appears on one security blocklist and lacks SSL certification, further degrading its legitimacy. No active content delivery networks or proxy services were detected in resolution paths. As of the latest verification, aad.ttkshop22.vip has been taken offline, reducing immediate exposure. However, the infrastructure remains a latent risk due to the recent creation date and the registrar's history of hosting similar threats. Organizations should maintain blocklist entries for the domain and IP, monitor for re-registration attempts, and alert users to verify Apple-related communications through official channels. The absence of SSL and the use of a non-standard page title should be incorporated into detection logic for related campaigns.