tiiktoktop[.]com

The domain tiiktoktop.com was registered on February 21, 2026 and is currently listed as offline. The site was blocked by the PhishDestroy sinkhole, indicating that it was actively serving malicious content before takedown. Network resolution points to the IP address 104.21.28.237, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. Cloudflare is a widely used content delivery network, and the use of its infrastructure is common among phishing operators seeking rapid deployment and anonymity.

The domain presented an SSL certificate identified as WE1, suggesting the presence of a valid TLS layer that could lend credibility to phishing attempts. VirusTotal analysis recorded 12 detections out of 93 security vendors, demonstrating that a minority of scanners identified malicious behavior while the majority did not flag the domain. The domain also appears on one external security blocklist, reinforcing the notion that at least one independent threat‑sharing source recognized it as abusive. Gridinsoft assigned a trust score of 0 out of 100, reflecting an extremely low confidence rating for the site’s legitimacy.

No additional intelligence such as page titles, brand targeting, or specific phishing kits was available at the time of analysis. The combination of recent registration, Cloudflare hosting, a valid TLS certificate, and multiple vendor detections aligns with typical phishing infrastructure patterns. Defenders should continue to monitor DNS queries for tiiktoktop.com and its associated IP address, enforce blocking of the domain and IP at perimeter defenses, and consider sharing the indicator set with upstream threat‑intel platforms. Given the offline status, any residual activity would likely stem from cached DNS entries or previously delivered payloads, so remediation of affected endpoints and credential resets are advisable where user interaction may have occurred.