apptknowshop[.]com

Analysis of apptknowshop.com, observed on July 24 2026, indicates a brand‑impersonation campaign targeting TikTok. The domain was registered through Hosting Concepts B.V. d/b/a Registrar.eu and created on 25 April 2025. DNS resolves to 104.21.90.188, an address owned by Cloudflare (AS13335) and located in the United States. The authoritative nameservers corey.ns.cloudflare.com and kenia.ns.cloudflare.com confirm the use of Cloudflare’s CDN. No TLS certificate is presented, meaning the site is served over HTTP only, despite the presence of HSTS and HTTP/3 headers reported by the scanner. The landing page title “Get your first business on TikTok Shop today!” explicitly references the TikTok brand, matching the listed impersonated brand.

Security‑vendor intelligence shows 16 of 95 scanners on VirusTotal flag the domain, and AlienVault OTX lists it in 16 separate threat‑intel pulses. PhishDestroy has already added the domain to its blocklist, and it also appears on one additional security blocklist. The Gridinsoft trust score of 1/100 reflects an extremely low reputation. Detected web technologies include Nginx, Swiper, jQuery, HSTS, and HTTP/3, which are consistent with a typical CDN‑hosted phishing site. The campaign is classified as “Social Media Phishing” in the intelligence feed, and the page title suggests an attempt to lure victims into creating a TikTok Shop business account, a common lure for credential harvesting.

Because the site is currently taken offline, active traffic cannot be measured, but the infrastructure choices—Cloudflare front‑end, lack of TLS, low trust score, and multiple vendor detections—indicate a deliberate attempt to evade easy detection while exploiting brand trust. Defenders should block the domain at DNS and proxy layers, monitor for outbound connections to 104.21.90.188, and add the associated IP and hostnames to threat‑intel feeds.