mail[.]zpejy[.]app

The domain mail.zpejy.app was registered through Dynadot LLC on August 10, 2025 and is currently reported as offline. DNS resolution points to the IPv4 address 38.46.13.34, which is associated with AS9294 GNET INC. and geolocated to Hong Kong. The authoritative nameservers are ns1.dnsip.com and ns2.dnsip.com.

No TLS certificate was observed for the host, indicating that HTTPS was not offered. The site presents a page title of "TikTok," confirming the intent to impersonate the TikTok brand, and the threat is classified as a brand impersonation campaign targeting TikTok users. VirusTotal analysis recorded 16 detections out of 93 submitted security vendors, suggesting a moderate level of malicious labeling by third‑party scanners. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy feed, reinforcing its malicious classification.

Independent trust scoring from Gridinsoft assigned a zero‑out‑of‑100 rating, reflecting an extremely low reputation. Defenders should incorporate the IPv4 address 38.46.13.34 and the domain name into network‑level blocklists, ensure that any inbound connections to the associated nameservers are monitored, and consider adding the domain to endpoint URL filtering policies. Continuous monitoring of the registrar Dynadot LLC for related registrations is advised, as is periodic re‑query of VirusTotal and other sandbox services for any changes in detection counts. Because the site is presently offline, active takedown verification is not possible, but the documented infrastructure and detection evidence justify pre‑emptive defensive actions.