demo[.]zpejy[.]app

The domain demo.zpejy.app is currently flagged as a brand‑impersonation site targeting TikTok. Registration data shows the domain was created on August 10, 2025 through Dynadot LLC, and it resolves to the IPv4 address 38.46.13.34, which is assigned to an Asian network (AS9294 GNET INC.) located in Hong Kong. DNS resolution uses the authoritative name servers ns1.dnsip.com and ns2.dnsip.com. No TLS certificate is presented for the host, indicating the site operates without HTTPS protection. The page title returned by the server is "TikTok", matching the declared brand target and confirming the intent to masquerade as the official service.

Infrastructure analysis reveals a trust score of 0 out of 100 from Gridinsoft, suggesting the host is considered highly suspicious. VirusTotal scans have returned 16 positive detections out of 93 antivirus engines, reinforcing the malicious classification. The domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy service, which is consistent with its offline status at the time of this assessment. No additional evidence such as content screenshots or HTTP response codes is available, so the exact user‑facing payload remains unknown.

Given the convergence of registrar, IP‑geolocation, low trust score, lack of encryption, and multiple vendor detections, defenders should treat demo.zpejy.app as a high‑confidence malicious indicator. Recommended actions include adding the domain to network and endpoint blocklists, monitoring DNS queries for the associated name servers, and enforcing TLS inspection policies that would have detected the absence of a valid certificate. Continuous re‑evaluation is advised in case the site becomes active again or additional indicators emerge.