tk29[.]o00[.]shop

On July 23, 2026, tk29.o00.shop was observed in an elevated‑risk brand‑impersonation campaign targeting TikTok. The domain was registered through Gname.com Pte. Ltd. and created on 20 October 2025. DNS resolution points to the IPv4 address 8.211.28.253, which is assigned to AS45102, identified as Alibaba (US) Technology Co., Ltd., and geolocated to Germany. The authoritative nameservers a12.share-dns.com and b12.share-dns.net are consistent with the hosting provider’s shared‑DNS service. The site served no TLS certificate, leaving the HTTP connection unencrypted.

The only page title retrieved reads “立即在 Tiktok Shop 開展您的業務！”, directly referencing TikTok Shop in Chinese and aligning with the declared brand‑impersonation intent. Gridinsoft assigned a trust score of 0 out of 100, indicating maximal suspicion. PhishDestroy has already blocked the domain, and it appears on one external security blocklist. VirusTotal analysis shows that 15 of 95 scanned security vendors flagged the domain as malicious, providing independent corroboration of its abuse. Current HTTP status is offline, suggesting the operator may have removed the site after detection.

The available evidence confirms that the domain is being used to masquerade as an official TikTok service, likely to lure users into fraudulent interactions. However, the exact payload, credential‑stealing mechanisms, or redirection behavior remain unknown because the site is no longer reachable for content inspection. Defenders should continue to monitor the associated IP address 8.211.28.253 and the hosting ASN for related activity, enforce blocklisting of the domain in web filters, and update endpoint protection signatures to reflect the observed VirusTotal detections. Organizations that rely on TikTok services should educate users about the absence of TLS on this domain and advise them to verify URLs against official TikTok domains.