tk-asiashop06[.]shop

Analysis of tk-asiashop06.shop indicates an active Apple brand impersonation campaign that was taken offline prior to the report date of July 23, 2026. The domain was registered on December 2, 2025 through Gname.com Pte. Ltd. and resolves to the IP address 156.238.246.229, which is hosted in Hong Kong under AS137899 (I LAYER LIMITED). The domain uses the public nameservers a.share-dns.com and b.share-dns.net and does not present an SSL certificate, suggesting it was served over plain HTTP. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of legitimacy.

VirusTotal recorded detections from 20 of 95 security vendors, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain, and AlienVault OTX has referenced it in 14 threat‑intelligence pulses, reinforcing its association with malicious activity. The page title returned by the server is "TikTok," which does not match the advertised Apple impersonation, highlighting a possible attempt to confuse automated detection tools. Current status shows the site is offline, but the underlying infrastructure—including the IP address and DNS configuration—remains observable.

Defenders should continue to enforce blocking of both the domain and its associated IP, update URL filtering and DNS sinkhole rules, and monitor for newly registered domains using the same registrar or similar naming patterns. Additional vigilance is advised for any future HTTP services hosted on the same IP range, given the lack of TLS and the low trust score. Monitoring OTX pulses and other threat‑intel feeds for reappearance of the domain or related indicators will aid in early identification of any resurgence.