tiktok-jn5[.]cc

Analysis conducted on July 25, 2026 identifies the domain tiktok-jn5.cc as an active component of a crypto‑scam infrastructure that masquerades as the brand “Across”. The domain was registered on February 21, 2026 and resolves to the IP address 172.67.176.176, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. SSL inspection shows the site presented a certificate identified as “WE1”, indicating the use of a publicly available TLS certificate rather than a brand‑specific certificate. The page title returned from the HTTP response is “TK-Store | buy, sell and discover on TK”, which does not reference the impersonated brand and suggests a generic storefront front‑end used to lure victims into a cryptocurrency transaction flow.

VirusTotal reports that 13 out of 93 scanning engines flagged the domain, confirming a moderate level of detection across commercial threat‑intelligence sources. The domain appears on a single security blocklist and has been explicitly blocked by the PhishDestroy remediation service. Independent trust scoring from Gridinsoft assigns a score of 0 out of 100, indicating a complete lack of trustworthiness. The current HTTP status is offline, and the domain has been taken down, but historical evidence shows it was operational long enough to attract detection.

Defenders should add tiktok-jn5.cc to DNS and URL filtering policies, enforce blocking of the associated IP range, and consider sinkholing the Cloudflare‑hosted address to disrupt any residual command‑and‑control traffic. Ongoing monitoring of the AS13335 address space for newly created sibling domains is recommended, as threat actors frequently recycle Cloudflare infrastructure for rapid deployment. Because the site’s content has not been captured, investigators should request a forensic snapshot from any available web archives to confirm the exact phishing or crypto‑drain mechanisms employed.