app[.]hdmkf[.]com

Analysis of the domain app.hdmkf.com indicates a high‑risk brand‑impersonation operation targeting the brand Base. The domain was registered on May 23, 2025 through Alibaba Cloud Computing Ltd. d/b/a HiChina (www.net.cn) and is served by the nameservers dns3.hichina.com, dns4.hichina.com, ns1.judns.com and ns2.judns.com. Infrastructure resolution points to the IP address 137.220.152.151, which is allocated to AS4907 BGPNET PTE. LTD. in Hong Kong.

No SSL certificate is present, suggesting the site was delivered over HTTP only. The page title returned from the live site was "TikTok Shop," but the content has not been captured for further forensic review. Security telemetry shows the domain appears on a single blocklist and has been actively blocked by PhishDestroy. Google Safe Browsing classifies the domain as a social‑engineering threat, and VirusTotal records 15 detections out of 95 scanned security vendors, reinforcing the malicious assessment. Reputation services assign extremely low trust scores: Gridinsoft reports 0 / 100 and Scamadviser 1 / 100, reflecting a lack of legitimacy.

Current status is offline, which may be temporary or a takedown attempt; however, the underlying infrastructure could be reused for future campaigns. Defenders should continue to monitor the associated IP range and the registrar’s name servers for new domains that exhibit similar registration patterns. Blocking the domain at network perimeter, updating URL filtering lists, and incorporating the IP address into threat‑intel feeds are recommended. Because the site’s content has not been archived, further analysis of the payload and any credential‑harvesting mechanisms remains uncertain and should be pursued if the domain resurfaces.