tkmallalliancen003[.]shop

This domain, tkmallalliancen003.shop, is flagged as an active brand impersonation threat targeting Apple users. Analysis indicates the infrastructure was designed to mimic Apple’s official branding while presenting a page titled 'TikTok shop,' suggesting an attempt to deceive users into believing they were interacting with a legitimate e-commerce platform. The domain does not appear to host a crypto drainer kit but instead focuses on credential theft or fraudulent transactions under the guise of Apple’s identity. No associated malware payloads have been confirmed at this time, though the misdirection to a TikTok-themed page raises concerns about social engineering tactics. Infrastructure analysis reveals the domain was registered on February 21, 2026, and resolves to the IP address 134.122.147.134, hosted under AS152194 (CTG Server Limited) in Japan. The SSL certificate is classified as R13, a non-standard designation that may indicate automated or low-trust issuance. As of the latest scan, 16 out of 95 security vendors on VirusTotal have flagged the domain as malicious. The domain appears on two independent security blocklists and is currently blocked by at least two threat intelligence feeds. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though this may reflect a lag in propagation rather than a clean status. The domain has since been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, the infrastructure remains a residual risk due to the domain’s recent creation date and the potential for re-activation under a different IP or registrar. Users who may have interacted with the site are advised to monitor for unauthorized account access, particularly on Apple or financial services linked to the TikTok shop pretext. Organizations should update blocklists to include this domain and its resolving IP, while individuals should verify the legitimacy of any unexpected e-commerce or brand communications, especially those redirecting to third-party platforms.