m[.]juyhgtfrd[.]cc

Analysis of the domain m.juyhgtfrd.cc shows a clear pattern of brand impersonation targeting TikTok. The domain was registered on October 28, 2025 through Gname.com Pte. Ltd. and resolves to the IP address 137.220.154.61, which is hosted in Hong Kong under ASN 4907 (BGPNET PTE. LTD.). No TLS certificate is presented, indicating that the site is served over plain HTTP only. The authoritative nameservers listed are a5.share-dns.com and b5.share-dns.net, both commonly associated with disposable or shared DNS services.

The page title returned by the server is "TikTok.Shop", directly referencing the TikTok brand and confirming the intent to mislead users. VirusTotal records show that 15 of 95 security vendors have flagged the domain, reflecting a moderate level of detection across the community. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a malicious resource. Gridinsoft assigns a trust score of 0 out of 100, indicating no confidence in the domain’s legitimacy.

Current network observations indicate the domain is taken offline, but the infrastructure components remain observable and could be re‑activated. Defenders should continue to block the IP address 137.220.154.61 and the domain name in perimeter security controls, monitor for any re‑registration or resurrection of the host, and update threat intelligence feeds with the observed indicators of compromise. Additional investigation is needed to determine whether the site previously hosted credential‑harvesting forms or other payloads, as the content of the page beyond the title has not been captured. Until such details are known, the precautionary stance should remain elevated due to the confirmed brand impersonation and the presence of multiple vendor detections.