trk[.]promised-forward-silk-pile[.]run

Analysis of trk.promised-forward-silk-pile.run as of July 25, 2026 shows the domain was provisioned through Cloudflare, Inc. and hosted on an Nginx/OpenResty stack behind a Let’s Encrypt R13 certificate. The site resolved to IP 23.44.136.80, which belongs to AS20940 Akamai International B.V. in the United States. The page title returned “TikTok – Make Your Day”, indicating an attempt to lure users with a familiar brand reference, although the page content has not been captured. VirusTotal scans recorded nine positive detections out of ninety‑five antivirus engines, confirming multiple security products flagged the site as malicious.

Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the malicious assessment. The domain is currently taken offline, appears on a single security blocklist, and has been actively blocked by the PhishDestroy feed. Nameserver information could not be retrieved (NS_NOT_FOUND). Because the domain was flagged by nine antivirus engines, defenders should review logs for any prior connections to the IP address or TLS handshake records that match the Let’s Encrypt certificate fingerprint.

Immediate actions include adding trk.promised-forward-silk-pile.run to URL filtering and DNS sinkhole lists, enforcing a block on the associated IP 23.44.136.80, and monitoring for any new subdomains that resolve to the same ASN. The offline status does not guarantee the threat is removed; threat actors often reactivate infrastructure after takedown, so continuous observation of Cloudflare‑registered domains targeting the TikTok brand is advised. Organizations using web‑proxy or secure web gateway solutions should ensure that requests to this host are denied, and incident response teams should be alerted if internal users report attempted navigation to the URL.