32657[.]app

The domain 32657.app was registered through Dynadot LLC on September 03, 2025 and is currently listed as offline. Infrastructure analysis shows the domain resolves to IP address 38.46.13.34, which belongs to AS9294 GNET INC. and is geolocated in Hong Kong. No SSL/TLS certificate is presented for the host, indicating that any HTTPS connections would be unencrypted or rejected. The authoritative nameservers are adrian.ns.cloudflare.com and ken.ns.cloudflare.com, both operated by Cloudflare, a common choice for rapid deployment of malicious sites.

The observed page title is "TikTok," and the threat is classified as a brand‑impersonation campaign targeting the TikTok platform. VirusTotal has recorded detections from 16 of 93 security vendors, reflecting a moderate level of consensus that the domain hosts malicious content. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service. AlienVault OTX lists the domain in three separate threat‑intel pulses, further corroborating its association with phishing activity.

Gridinsoft assigns a trust score of 0 out of 100, indicating a complete lack of trustworthiness. Because the site is taken offline, direct content inspection is not possible, and the exact payload or credential‑harvesting mechanisms remain unknown. Defenders should continue to block 32657.app at the DNS and network layers, add the associated IP 38.46.13.34 to blacklists, and monitor for any re‑hosting attempts that might use the same infrastructure. Ongoing vigilance is advised, especially for users of TikTok who may receive unsolicited messages directing them to a site claiming to be TikTok, as the domain’s historical behavior aligns with brand‑impersonation tactics.