ospmmall[.]com

Analysis as of July 24, 2026 indicates that the domain ospmmall.com is associated with a brand‑impersonation campaign. The domain was registered on April 25 2025 through Gname.com Pte. Ltd. and is hosted behind Cloudflare (ASN 13335). DNS resolution points to the IP address 172.67.223.249, which is owned by Cloudflare in the United States. The authoritative name servers are daphne.ns.cloudflare.com and doug.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No TLS certificate is presented, meaning the site is served over plain HTTP, which further reduces trustworthiness.

The publicly visible page title “TK‑Store | buy, sell and discover on TK” does not reference the targeted brand and suggests a generic e‑commerce façade. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. AlienVault OTX has indexed the domain in sixteen separate threat‑intel pulses, indicating repeated observation by the community. PhishDestroy has actively blocked the domain, and VirusTotal records fifteen of ninety‑five security vendors flagging the host as malicious, reinforcing the suspicion of abuse. The campaign is classified as brand impersonation, with the “impersonates” field listed as “across”, implying that the operator may target multiple brands rather than a single named entity.

Because the site is currently offline, real‑time verification of the payload or phishing page content is not possible; therefore the exact brands being spoofed remain uncertain. Defenders should continue to block the domain at perimeter filters, update URL‑filtering lists, and monitor for any re‑activation of the host. Additional scrutiny of traffic to the associated IP address and Cloudflare‑served subdomains is advised, as threat actors may reuse the same infrastructure for future campaigns. Ongoing observation of OTX feeds and VirusTotal detections will provide early warning if the domain resurfaces.