tiktokshopcn[.]shop

The domain tiktokshopcn.shop was observed on July 22, 2026 delivering a brand‑impersonation campaign targeting TikTok. The site returns HTTP 200 and presents the page title “TikTokMall”, which aligns with the declared brand target. Technical fingerprinting shows the site is hosted on IP 156.238.252.121, a server registered to Cognetcloud Inc. in the United States. Registration records list the registrar as ALIBABA.COM SINGAPORE E‑COMMERCE PRIVATE LIMITED, and the authoritative name servers are ns7.alidns.com and ns8.alidns.com. The service is protected by a Let’s Encrypt certificate (issuer YE2) and the web stack reports Nginx serving a front‑end built with Vue.js.

Google Safe Browsing classifies the URL as a social‑engineering threat, and the domain appears on one public blocklist, where it has been explicitly blocked by the PhishDestroy service. VirusTotal analysis shows six of ninety‑one scanning engines flag the domain as malicious, indicating a moderate level of consensus among security vendors. The overall risk rating is high and the campaign remains active. Evidence confirms that the infrastructure is deliberately configured to resemble a legitimate TikTok commerce portal, yet no direct inspection of page content is available in the current intelligence set.

Consequently, the exact credential‑harvesting mechanisms or payload delivery methods cannot be verified at this time. Defenders should prioritize immediate network‑level denial of tiktokshopcn.shop and its resolved IP address, incorporate the domain into URL filtering and email security policies, and monitor for related sub‑domains that may share the same name‑server configuration. Continuous re‑scanning of the site with sandbox and reputation services is advisable to capture any evolution in the malicious payload. Organizations should also advise end‑users to treat unsolicited TikTok‑related links with suspicion, especially those directing to domains outside the official TikTok ecosystem.