app[.]tikappdownyuyi[.]cc

The domain app.tikappdownyuyi.cc was registered on December 27, 2025 and is currently reported as taken offline. Infrastructure analysis shows the domain resolves to the IP address 137.220.152.151, which is hosted in Hong Kong under AS4907 BGPNET PTE. LTD. The authoritative nameservers are becky.ns.cloudflare.com and conrad.ns.cloudflare.com, indicating the use of Cloudflare DNS services. No SSL certificate is presented, meaning the site would have been served over plain HTTP if it were active.

The registrar listed is Spaceship, Inc., and the domain is flagged as a brand‑impersonation campaign targeting the brand "base" according to the supplied intelligence. VirusTotal scans indicate that 18 out of 93 security vendors have flagged the domain, providing a moderate level of detection confidence across multiple independent scanners. Additional risk indicators include a Gridinsoft trust score of 0 out of 100 and inclusion on a single external blocklist, which corroborates the suspicion that the domain is malicious. The page title captured during the brief appearance was "TikTok Shop," but no further content analysis is available. PhishDestroy has already added the domain to its blocklist, suggesting that at least one anti‑phishing service has taken mitigation steps.

Defenders should add the domain and its resolved IP address to DNS sinkhole or firewall deny lists, ensure that any outbound traffic to the HK‑based hosting network is monitored, and watch for future registrations that reuse the same nameserver pair or registrar. Because the site lacks TLS, network‑level inspection can be employed without decryption concerns. Continuous monitoring of VirusTotal and other multi‑vendor aggregation services for new detections is advised, as additional vendor votes may emerge if the operator attempts to reactivate the domain.