profile[.]27836[.]click

This investigation documents the infrastructure and threat indicators associated with profile.27836.click, which is classified as a TikTok brand impersonation site. The domain was registered on 20 April 2025 through Dynadot LLC and is served by the authoritative name servers ns1.dnsip.com and ns2.dnsip.com. DNS resolution points to the single IPv4 address 38.46.13.34, which belongs to ASN 9294 operated by GNET INC. and is geolocated in Hong Kong. No TLS certificate is presented, indicating that the site is delivered over plain HTTP only.

The page title returned from the server is “TikTok”, matching the declared brand target. Multiple security aggregators have flagged the host. VirusTotal records show that 16 of 93 scanned engines marked the domain as malicious, and Gridinsoft assigns a trust score of zero out of one hundred. The domain appears on one external blocklist and has been added to the PhishDestroy blocklist, confirming that defensive feeds are already distributing indicators of compromise.

The lack of an SSL certificate, combined with the low trust rating and multiple vendor detections, suggests a high likelihood of malicious intent despite the current offline status. Open questions remain regarding the exact payload or credential‑harvesting mechanism, as the site content has not been captured and no malware signatures have been published. Analysts should continue to monitor the IP address for any resurgence, enforce blocking of the domain and associated IP in perimeter defenses, and consider adding the nameserver entries to local deny lists. Retrieval of the HTTP response body, if the site returns online, would enable confirmation of the phishing page structure and support attribution efforts.