tkshopryi[.]top

The domain tkshopryi.top has been identified as a credential theft operation, specifically designed to harvest user login credentials through deceptive brand impersonation. Analysis indicates the domain is currently offline, though prior activity suggests it mimicked legitimate e-commerce platforms under the guise of TK-SHOP to lure victims. The threat type aligns with known credential theft campaigns, where attackers replicate trusted interfaces to capture sensitive account details. Infrastructure analysis reveals the domain was registered through Domain International Services Limited on November 12, 2025, and resolves to the IP address 111.68.5.130, hosted under AS45753 (Netsec Limited) in Hong Kong. Security vendors flagged the domain in 17 of 95 VirusTotal scans, while it appears on two independent blocklists, including PhishDestroy and PhishingDB. The absence of an SSL certificate further undermines its legitimacy, as encrypted connections are a baseline expectation for secure transactions. Detection rates and blocklist inclusion corroborate the elevated risk classification assigned to this domain. Current status confirms tkshopryi.top has been taken offline, though similar credential theft domains often resurface under new registrations. Organizations and users are advised to monitor for recurring patterns, such as domains registered through the same registrar or resolving to the same IP range. Network-level blocking of 111.68.5.130 and related AS45753 infrastructure is recommended to mitigate residual risk. Endpoint protection should be configured to detect and alert on domains matching the TK-SHOP impersonation scheme, particularly those lacking SSL encryption or exhibiting recent creation dates.