2rhlubiwm4[.]46464tk[.]com

This domain, 2rhlubiwm4.46464tk.com, is identified as a brand impersonation threat targeting the TikTok Shop Foundation. Analysis confirms the domain was actively used to mimic official Foundation-related services, likely to deceive users into disclosing sensitive information or engaging in fraudulent transactions. The current status of the domain is offline, though prior activity warrants continued monitoring. Infrastructure analysis reveals the domain was registered on November 07, 2025, through Gname.com Pte. Ltd. and resolved to the IP address 118.193.68.138, hosted under AS135377 UCLOUD INFORMATION TECHNOLOGY (HK) LIMITED in South Korea. Security vendors flagged the domain as malicious, with 16 out of 95 VirusTotal engines detecting suspicious activity. The domain appears on two security blocklists, including PhishDestroy and PhishingDB, and was secured with a Let's Encrypt SSL certificate (R12). The page title, TikTOK Shop, further corroborates the intent to impersonate official TikTok Foundation services. Given the elevated risk level and historical threat activity, organizations and users are advised to treat this domain as compromised. Immediate actions should include blocking the domain and its associated IP (118.193.68.138) at the network perimeter, updating endpoint protection rules to prevent access, and monitoring for residual connections. Users who may have interacted with the domain should verify account integrity, reset credentials, and review transactions for unauthorized activity. Proactive threat hunting for related indicators of compromise (IOCs) is recommended to mitigate potential exposure.