online[.]tkgetvipapp[.]cc

The domain online.tkgetvipapp.cc is identified as a brand impersonation threat targeting TikTok, specifically its e-commerce platform TikTok Shop. This infrastructure was designed to deceive users into registering for fraudulent business accounts under the guise of legitimate TikTok services. The domain is currently offline, but prior activity indicates a high-risk credential harvesting operation. Analysis of the domain reveals multiple technical indicators of malicious intent. The domain was registered on October 16, 2025, through NameSilo, LLC, and resolves to the IP address 103.122.245.79, hosted under AS152918 (Liberally Network LLC) in Hong Kong. It lacks an SSL certificate, increasing the risk of unencrypted data interception. Security vendors on VirusTotal flagged the domain at a rate of 17 out of 95, and it appears on two independent security blocklists. The page title, 'Get your first business on TikTok Shop today!', directly mimics TikTok’s branding to lure victims. The domain’s current offline status suggests either takedown or voluntary suspension by the threat actor. However, the infrastructure remains a documented threat due to its recent activity and technical indicators. Organizations and users are advised to block the domain and its associated IP at the network level. Security teams should monitor for similar domains registered through NameSilo or resolving to the same ASN. Users who interacted with the site should reset credentials and enable multi-factor authentication on all accounts, particularly those linked to TikTok or financial services.