secure[.]27836[.]click

Analysis of secure.27836.click shows a credential‑phishing infrastructure targeting the TikTok brand. The domain was registered through Dynadot LLC on 20 April 2025 and uses the authoritative name servers ns1.dnsip.com and ns2.dnsip.com. DNS resolution points to the IPv4 address 38.46.13.34, which belongs to AS9294 GNET INC. and is geolocated in Hong Kong. No TLS certificate is presented, indicating that the site was served over plain HTTP.

The page title returned by the server is “TikTok”, matching the declared brand target and confirming the impersonation intent. Gridinsoft’s proprietary trust‑score engine assigns a score of 0 / 100, reflecting a high confidence of malicious behavior. VirusTotal records show that 15 of 93 scanned security vendors flagged the domain, and the domain is listed on at least one public phishing blocklist, including PhishDestroy, which has already taken the site offline. The evidence collectively points to a credential‑phishing campaign that likely lures TikTok users into submitting login credentials. Open questions remain regarding the exact phishing page content, any backend command‑and‑control infrastructure, and whether the domain was used in active campaigns before the takedown.

Defenders should add the domain and its associated IP address to internal block lists, monitor for similar sub‑domains hosted on the same name servers, and enforce strict URL filtering for any HTTP resources referencing “tiktok” in the title. Continuous review of Dynadot‑registered domains and the GNET INC. IP range is recommended to catch future replicas. Threat‑intel feeds should be updated with the observed indicators to improve detection latency.