tk[.]mall-u1[.]top

The domain tk.mall-u1.top was registered on 23 June 2025 through Hosting Concepts B.V. operating under the Registrar.eu brand. DNS resolution points to the IPv4 address 45.205.26.150, which belongs to the FASTNET DATA INC network (AS8796) and is geolocated in the United States. The authoritative nameservers listed are ns1.regery.net, ns2.regery.net and ns3.regery.net. No TLS certificate was observed, indicating that the site does not serve content over HTTPS. The site’s HTTP title, captured before takedown, reads “TikTok-Wholesale”, which does not directly reference the targeted brand but the underlying intelligence classifies the activity as a brand impersonation campaign aimed at Binance. Gridinsoft assigned a trust score of zero out of one hundred, reflecting an extremely low reputation.

VirusTotal reports that sixteen of ninety‑five scanning engines flagged the domain, and the domain appears on a single security blocklist. PhishDestroy has also added tk.mall-u1.top to its block list, confirming active mitigation by at least one anti‑phishing service. The domain’s current HTTP status is offline, suggesting that the malicious content has been removed or the hosting provider has disabled the site. Analysis indicates that the infrastructure choices – a US‑based hosting provider, generic regery.net nameservers, and the absence of SSL – are typical of low‑cost phishing operations that rely on rapid deployment rather than persistence. While the page title does not reveal the Binance brand, the explicit “impersonates: binance” label confirms the intent to lure users seeking Binance services.

The limited detection coverage (16/95 vendors) and single blocklist listing imply that broader community awareness may still be developing. Defenders should continue to monitor DNS queries for the three regery.net nameservers and the IP address 45.205.26.150 for any re‑appearance of malicious content.