vip[.]batccesvitese[.]com

On 23 July 2026 analysts observed the domain vip.batccesvitese.com, created on 22 September 2025 and registered through Global Domain Group LLC. The domain resolves to the IPv4 address 45.194.37.96, which is allocated to Antbox Networks Limited (AS138995) and geolocated to Hong Kong. No TLS certificate is present, indicating the site was served over plain HTTP. The authoritative nameservers are becky.ns.cloudflare.com and conrad.ns.cloudflare.com, both belonging to Cloudflare's DNS service. The site’s page title was reported as “TikTok Mall”, and the listed brand target is TikTok Shop, classifying the activity as a brand‑impersonation campaign. PhishDestroy has already taken the domain offline and listed it as blocked.

VirusTotal analysis shows that 16 of 95 scanning engines flagged the domain as malicious, and the domain appears on one external security blocklist. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment. Evidence confirms that the infrastructure is hosted in Hong Kong and that the domain lacks encryption, which may facilitate credential harvesting or other malicious redirects, although the exact payload has not been captured. No additional indicators such as malicious URLs, scripts, or downloaded files have been released publicly, so the full operational profile remains uncertain.

Defenders should immediately add vip.batccesvitese.com and its resolved IP 45.194.37.96 to network blocklists and update DNS filtering rules. Continuous monitoring of the ASN AS138995 and the associated Cloudflare nameservers is advised to detect future re‑use of the same hosting assets. Organizations using TikTok Shop should issue user advisories warning against unexpected links to “TikTok Mall” and reinforce verification of legitimate TikTok URLs. Incident response teams should retain the domain, IP, and registrar information for attribution and consider sharing the indicators with relevant threat‑sharing platforms.