m11[.]ggdsa1d[.]cc

Analysis of m11.ggdsa1d.cc, observed on 23 July 2026, identifies a brand‑impersonation campaign targeting TikTok. The domain was registered through Gname.com Pte. Ltd. on 18 October 2025 and resolves to the IPv4 address 111.68.1.250, which is allocated to Netsec Limited (AS45753) in Hong Kong. The site presented the page title “TikTok.Shop”, reinforcing the impersonation of the TikTok brand. No TLS certificate was provisioned, indicating that the service operated over plain HTTP, a configuration commonly associated with malicious delivery.

VirusTotal recorded 14 detections out of 95 scanning engines, confirming that a notable subset of security vendors classify the domain as malicious. The Gridinsoft trust score of 0 out of 100 further corroborates the high‑risk assessment. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy service. Nameserver records point to a9.share-dns.com and b9.share-dns.net, both typical of shared DNS infrastructures used by disposable or low‑cost hosting providers.

Current status is offline, yet the infrastructure artifacts remain observable. Uncertainties remain regarding the exact phishing kit or payload used, as the page content has not been publicly disclosed beyond the title. Defensive recommendations include adding the IP 111.68.1.250 and the domain m11.ggdsa1d.cc to inbound and outbound filtering rules, monitoring future registrations under Gname.com Pte. Ltd. for similar patterns, and leveraging threat‑intel feeds that reference the associated blocklist entry. Continuous observation of the associated ASN and nameserver configuration is advised to detect potential re‑use of the hosting environment for new impersonation attempts.