scaleshop-asdasdasdasd-0-ws[.]netlify[.]app

Analysis of scaleshop-asdasdasdasd-0-ws.netlify.app indicates active infrastructure supporting a TikTok brand‑impersonation campaign. The site was registered on 21 April 2026 and is hosted on an Amazon EC2 instance in the Frankfurt (eu‑central‑1) region, resolving to 35.157.26.135. Netlify is listed as the registrar, and the domain serves a permanent redirect (HTTP 301) under a DigiCert Global G2 TLS RSA SHA‑256 certificate. The page title returned by the server is “TikTok Shop”, matching the declared target brand. Security telemetry shows a low Gridinsoft trust score (0/100) and twelve of ninety‑four VirusTotal scanners flag the domain, suggesting malicious payloads or phishing components. The domain appears on a single external blocklist and is currently blocked by PhishDestroy. No nameserver records were retrieved. While the exact page content has not been captured, the combination of brand‑impersonating title, recent registration, redirection, and multiple vendor detections warrants a high‑risk classification. Defenders should block the hostname at network perimeter, add it to URL filtering and sinkhole lists, and monitor for any related C2 traffic from the associated AWS IP range. Ongoing observation of Netlify‑hosted assets and periodic re‑scanning are advised to detect any evolution of the campaign.