tiktoks11252[.]cloudnfla[.]com

The domain tiktoks11252.cloudnfla.com is flagged for brand impersonation, specifically targeting Apple. The threat type is categorized as brand impersonation, and the domain does not appear to be using any specific drainer kit. The page title found was 'TikTok-Shop', which suggests an attempt to leverage the TikTok brand to mislead users.

Analysis indicates that the domain has a VirusTotal score of 17/95, suggesting that 17 out of 95 security vendors have flagged this domain as malicious. The domain was registered through Cloud DNS Ltd and resolves to the IP address 104.26.0.97, which is located in the United States and is part of AS13335 Cloudflare, Inc. The domain was created on September 25, 2025, and does not have an SSL certificate. It appears on 2 security blocklists, specifically PhishDestroy and PhishingDB, and is not currently listed in the Google Safe Browsing database.

The current status of the domain is offline, indicating that it has been taken down or is no longer active. Despite this, the infrastructure remains a concern as it has been flagged by multiple security vendors and appears on blocklists. Organizations and individuals should remain vigilant and continue to monitor for any reactivation of the domain or related phishing activities. The elevated risk level suggests that further security measures, such as updating blocklists and educating users about the threat, should be considered to mitigate potential risks.