stiktok-page[.]pages[.]dev

This domain, stiktok-page.pages.dev, is flagged as a generic phishing resource targeting users seeking TikTok video download services. Analysis of the page title, 'TikTok Downloader - Download TikTok video without watermark, Convert TikTok video to MP3,' indicates an attempt to impersonate legitimate media conversion tools. Such domains typically harvest user credentials, distribute malicious payloads, or deploy browser-based drainer kits to extract sensitive information under false pretenses. No specific drainer kit signatures have been confirmed at this stage, though the impersonation of a high-traffic platform like TikTok aligns with common credential theft tactics. Infrastructure analysis reveals the domain was registered on April 02, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.44.208, geolocated to a Cloudflare node in Canada. Detection metrics show a VirusTotal score of 0/95, indicating no antivirus engines have flagged the domain as malicious at the time of this report. However, it appears on one security blocklist, suggesting preliminary detection by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services (WE1), a common provider for both legitimate and malicious domains leveraging Cloudflare’s infrastructure. The domain remains active and under investigation, with no takedown or sinkholing actions observed. Users are advised to exercise caution when encountering unsolicited media download tools, particularly those hosted on content delivery networks or subdomains of legitimate services. Organizations should monitor for connections to 172.66.44.208 and the domain stiktok-page.pages.dev in network logs, as these may indicate compromised endpoints or policy violations. Further analysis is required to determine the full scope of the campaign and potential secondary payloads.