tkmall78[.]vip

This domain, tkmall78.vip, is flagged as a brand impersonation phishing site targeting the 'across' brand. Analysis of the page title, 'TK-Store | buy, sell and discover on TK,' indicates an attempt to mimic a legitimate e-commerce platform, likely to deceive users into entering credentials or financial information. No specific drainer kit signatures were identified in initial scans, but the domain exhibits characteristics consistent with credential harvesting or fraudulent transaction pages. Technical indicators confirm elevated risk. The domain was registered on May 26, 2025, through Global Domain Group LLC and resolves to the IP address 134.122.166.179, hosted in Japan under AS152194 (CTG Server Limited). VirusTotal detections show 19 out of 95 security vendors flagging the domain as malicious. It appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is commonly leveraged by threat actors to lend false legitimacy to phishing sites. As of the latest verification, tkmall78.vip has been taken offline, reducing immediate exposure. However, the infrastructure remains a residual risk. The domain's recent creation date, combined with its rapid detection by security vendors, suggests it may have been part of a short-lived campaign. Organizations should monitor for related domains registered under the same registrar or resolving to the same IP range. Users who interacted with the domain should reset credentials for any associated accounts and review financial transactions for unauthorized activity. Proactive blocking of the domain and its resolving IP is recommended for network-level protection.