hjycdc[.]sbs

On 23 July 2026 the domain hjycdc.sbs was observed being used for a TikTok brand impersonation campaign. The domain was registered on 10 August 2025 through Dynadot LLC and is delegated to the authoritative nameservers ns1.dnsip.com and ns2.dnsip.com. DNS resolution points to the IPv4 address 38.46.13.34, which is announced by AS9294 GNET INC. and geolocated to Hong Kong. No TLS certificate is present, indicating that the service is delivered over plain HTTP.

The HTTP response delivers a page whose title is “TikTok”, matching the declared brand target. Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on a single security blocklist. VirusTotal analysis shows that 16 of 93 scanning engines flagged the domain, indicating a moderate level of detection across vendors. AlienVault OTX references the domain in two independent threat‑intel pulses, providing additional corroboration of malicious use.

PhishDestroy has recorded the domain as blocked, and the current operational status is offline, suggesting that the phishing infrastructure has been taken down or is no longer active. Defenders should continue to monitor the associated IP address and ASN for any re‑use, enforce blocklists that include hjycdc.sbs, and consider adding the domain to internal denial‑list rules. Because the site no longer serves content, further forensic capture is not possible, and the exact payload or credential‑harvesting mechanisms remain uncertain. Ongoing observation of related subdomains or future registrations using the same nameservers may reveal additional campaign activity.