xdzuot6a[.]ridistrict[.]com

This domain is flagged as an elevated-risk generic phishing threat targeting users of a platform branded as TK Store. Analysis indicates the infrastructure was designed to mimic a buy/sell/discovery service, likely to harvest credentials or financial details from unsuspecting victims. The threat type is classified as generic phishing due to the absence of a confirmed legitimate brand association, though the page title explicitly references TK Store, suggesting an intent to deceive users familiar with such services. Infrastructure analysis reveals the domain xdzuot6a.ridistrict.com was registered on February 21, 2026, through Gname.com Pte. Ltd. It resolves to the IP address 45.135.237.29, located in Hong Kong under AS153656 (OWGELS INTERNATIONAL CO., LIMITED). The SSL certificate is issued by Let's Encrypt (serial number E8), a common choice for both legitimate and malicious domains. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain appears on two security blocklists and is explicitly blocked by PhishDestroy and PhishingDB. The page title, "TK Store | buy, sell and discover on TK," further corroborates the phishing intent, though no direct ties to a known legitimate brand have been established. Mitigation steps for this threat include immediate blocking of the domain and its associated IP address (45.135.237.29) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to xdzuot6a.ridistrict.com and monitor for related indicators of compromise, such as unusual login attempts or financial transactions. Users who may have interacted with the domain should be advised to reset credentials for any accounts accessed during the exposure window, particularly if they reused passwords or entered payment details. Security teams should review logs for connections to the IP address and domain to identify potentially compromised systems. Given the domain's current offline status, proactive measures should focus on preventing future access attempts and monitoring for resurgence under similar infrastructure.