app[.]tshoptav[.]vip

Analysis of app.tshoptav.vip indicates a high‑confidence brand impersonation campaign targeting the Base brand. The domain was registered through NameSilo, LLC on September 14, 2025 and is presently taken offline according to current monitoring. Infrastructure inspection shows the domain resolves to IP address 206.119.72.215, which belongs to AS8796 FASTNET DATA INC and is hosted in the United States. The authoritative nameservers are alla.ns.cloudflare.com and kyree.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services.

No TLS certificate is presented, meaning the site operates without encryption, which is typical for malicious landing pages designed to avoid security warnings. The page title returned from HTTP queries is "tiktok shop," a mismatch that suggests the operator is leveraging popular e‑commerce terminology to lure victims, while the declared impersonated brand is Base, consistent with the reported scam type of brand impersonation. Reputation metrics are extremely low: Gridinsoft assigns a 0/100 trust score and Scamadviser a 1/100 score, reinforcing the malicious nature of the domain. Threat intelligence feeds list the domain on a single blocklist, PhishDestroy, and VirusTotal records show 16 out of 95 scanned security vendors flagging the domain as malicious, providing independent corroboration of its risk.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms, as no content analysis or SSL/TLS handshake data is available beyond the lack of a certificate. Defenders should immediately block traffic to app.tshoptav.vip at perimeter and endpoint layers, add the associated IP 206.119.72.215 to deny lists, and monitor Cloudflare name server activity for newly observed subdomains that may reuse the same infrastructure. Continuous observation of related brand‑impersonation patterns, especially those referencing Base or using similar "tiktok shop" titles, is recommended to pre‑empt future deployments.