chdmc[.]sbs

This domain, chdmc.sbs, is identified as a high-risk phishing infrastructure specifically targeting TikTok through brand impersonation. The domain is currently offline, though prior activity indicates it was actively used to deceive users into disclosing credentials or other sensitive information by mimicking official TikTok login or promotional pages. The page title explicitly displayed 'TikTok,' reinforcing the impersonation tactic to exploit user trust in the platform. Analysis of technical indicators reveals multiple red flags. The domain was registered through Dynadot LLC on August 11, 2025, and resolves to the IP address 38.46.13.34, hosted under AS9294 (GNET INC.) in Hong Kong. No SSL certificate was detected, increasing the likelihood of unencrypted data interception. Security vendors flagged the domain as malicious, with 17 out of 95 VirusTotal engines detecting it as phishing-related. Google Safe Browsing also marked it as a phishing threat, and it appears on at least one security blocklist. Infrastructure analysis further confirms its transient nature, as it was taken offline following detection, a common evasion tactic among threat actors. The risk posed by chdmc.sbs is classified as high due to its direct impersonation of a globally recognized platform, combined with its recent registration and lack of legitimate security measures. Organizations and users are advised to block the domain at the network level, including its associated IP (38.46.13.34), and monitor for any re-emergence under similar naming conventions. Security teams should update detection rules to include this domain and its indicators of compromise (IoCs) in threat intelligence feeds. End users should be educated on verifying domain authenticity before entering credentials, particularly for platforms frequently targeted by phishing campaigns.