pay[.]tiktokmart[.]shop

Analysis of pay.tiktokmart.shop indicates a high-risk brand impersonation campaign targeting TikTok users. The domain was registered on March 25, 2026, through GoDaddy.com LLC, a registrar frequently associated with both legitimate and malicious domains. Infrastructure analysis reveals the domain resolves to the IP address 100.49.110.141, which has not yet been widely documented in threat intelligence feeds but is flagged by two security blocklists: PhishDestroy and BLP-Malware. The SSL certificate, issued by GoDaddy.com, Inc., provides basic encryption but does not validate the legitimacy of the site’s operations or ownership. The page title, 'Online payment @ TikTok Mart,' explicitly suggests an attempt to mimic TikTok’s payment or e-commerce services, a common tactic in phishing campaigns designed to harvest financial credentials. Detection data from VirusTotal shows that 4 out of 95 security vendors have flagged the domain as malicious, a relatively low detection rate that may reflect the campaign’s recent activation or evasion techniques. The presence of Google Pay among detected technologies further supports the likelihood of a payment-focused phishing operation, as attackers often integrate recognizable payment gateways to lend false credibility to fraudulent checkout processes. Gridinsoft’s trust score of 0 out of 100 reinforces the domain’s high-risk classification, though the absence of broader detection does not rule out active malicious intent. The domain remains operational as of July 12, 2026, with no evidence of takedown or remediation efforts. Defenders should treat this domain as hostile and prioritize blocking or monitoring traffic to 100.49.110.141, particularly in environments where TikTok-related services are accessed. Organizations may also consider proactive measures such as sinkholing the domain or alerting users to the risks of interacting with unverified payment portals under the TikTok brand.