104[.]233[.]194[.]10[.]nip[.]io

On July 25, 2026 the domain 104.233.194.10.nip.io was observed serving an HTTP 200 response with the page title “TikTok Shop”. The site is protected by a Let’s Encrypt certificate (issuer E7) and resolves to the IPv4 address 104.233.194.10, which belongs to AS54600 PEG TECH INC located in the United States. Registration data show the domain was created on June 08, 2012 and was registered through NameCheap, Inc. The authoritative nameservers are ns-do-sg.sslip.io, ns-gce.sslip.io, ns-hetzner.sslip.io, and ns-ovh.sslip.io. Reputation services rate the domain extremely poorly; Scamadviser assigns a trust score of 1/100. VirusTotal analysis reports that eight of ninety‑five scanning engines have flagged the domain as malicious.

The domain appears on one security blocklist and is actively blocked by the PhishDestroy mitigation service. The threat classification is generic phishing with a high risk rating and the current status is active. Analysis indicates that the combination of a legitimate‑looking page title, a low‑cost registrar, and the use of a free SSL certificate is consistent with a credential‑harvesting campaign targeting users of the TikTok platform. The presence of multiple security vendor detections and blocklist listings provides corroborating evidence of malicious intent. However, the specific phishing kit, credential‑submission endpoint, and any associated command‑and‑control infrastructure have not been publicly disclosed, leaving those details uncertain.

Defenders should immediately add 104.233.194.10.nip.io to web‑filter blocklists and ensure that any outbound connections to the IP 104.233.194.10 are denied. Network‑level monitoring for DNS queries to the domain and TLS inspection of traffic to the Let’s Encrypt certificate can aid in detecting attempted access. Incident response teams should also correlate internal logs for any authentication attempts to TikTok services that coincide with connections to this domain.