A suspected fake TikTok Shop domain triggered 320,007 blocked requests in just five months, making up 19 per cent of all phishing-category blocks recorded globally by Surfshark's web protection tool.
The VPN company's figures, covering May to September, show a sharp rise in phishing-related activity on protected devices. Monthly phishing-category blocks climbed from 104,962 in April to 655,024 in September, while average blocks per protected device increased from 0.74 to 1.35.
Surfshark Data Points to Rising Phishing Exposure
Surfshark's blocklist is not a measure of confirmed victims. The company says its statistics represent blocked requests, not unique attacks, domains, users, victims or successful compromises.
A single device can generate multiple requests, and the phishing category may also cover advertising, tracking, adware or potentially unwanted infrastructure. The data indicates that more requests are being intercepted by Surfshark's tool, but does not show how many people were deceived or how much money was lost.
The suspected TikTok Shop-associated domain became a recurring presence in Surfshark's internal rankings. Monthly blocks linked to it rose from 16,995 in May to 125,413 in September, an increase of 638%, and it accounted for 22.2 per cent of all phishing-category blocks in August.
Surfshark's preliminary figures from 1 to 20 October recorded a further 96,711 blocks associated with the same domain. The company said it remained the most-blocked phishing-category domain in its global data during that partial period.
UK Exposure Climbs as Europe Sees Bigger Spikes
The same trend appeared in the UK, although the country's rate stayed lower than those reported for France and Italy. Blocks per protected device in the UK rose from 0.53 in April to 0.82 in September, an increase of 54 per cent.
The equivalent increase was 159 per cent in France, 99 per cent in Italy, 86 per cent in Spain and 38 per cent in Germany. In the US, blocks per protected device rose 87 per cent, from 0.50 to 0.93, while total phishing-category blocks increased from 20,519 to 122,580.
Surfshark's research does not name the domain publicly. It describes the infrastructure as consistent with a counterfeit TikTok Shop operation, and does not present the domain as a confirmed phishing site without qualification.
The findings sit alongside recent TechTimes coverage of 511 lookalike domains imitating trusted UK brands, although the two reports are based on separate datasets and are not directly comparable.
Fake Shops Signal a Broader Campaign
CTM360 said its separate 'FraudOnTok' investigation identified a global campaign involving fake TikTok Shop websites, lookalike domains and malicious applications. The cybersecurity company said the campaign included spyware capable of extracting sensitive information from compromised devices.
The report does not establish that the FraudOnTok campaign and Surfshark's unidentified domain are connected. It provides background on the wider use of TikTok Shop impersonation in phishing and malware operations.
TikTok published a warning in August 2025 about scammers impersonating TikTok and TikTok Shop through emails, texts, calls and links. The company advised users to check that links used the correct official domain and said it would not request passwords, one-time passcodes or payment-card details through those channels.
The issue is consistent with TechTimes' report on phishing pages imitating UK brands, where cloned login, delivery-tracking and billing pages were identified as tools for stealing credentials and payment information.
UK Blocking Efforts Offer Additional Context
The UK's National Cyber Security Centre has separately expanded efforts to block access to malicious websites. It said its Share and Defend service had blocked almost one billion attempts to access malicious websites in less than a year by sharing information about known fraudulent sites with internet service providers.
That system and Surfshark's web content blocker measure different forms of activity. The NCSC figure concerns access attempts blocked through a government and industry service, while Surfshark's figures concern requests categorised and blocked by its own product.
The distinction matters because neither figure is a direct count of successful scams. Together, they show activity being identified and blocked by separate cybersecurity systems, while leaving the number of affected victims unresolved.
