Fake TikTok Shop domain drove 19% of global phishing blocks in 5 months
Surfshark has identified a suspected fake TikTok Shop domain as the source of one in five global phishing blocks between May and September 2026. The domain triggered over 320,000 blocks, with activity expected to rise further ahead of Black Friday. Phishing exposure surged across Europe and the US, highlighting risks for e-commerce operators during peak shopping periods.
Editor, Lazyfounder
30 SEC SUMMARY
- Surfshark reported a 638% increase in phishing blocks tied to a suspected fake TikTok Shop domain between May and September 2026.
- The fake domain accounted for 19% of global phishing blocks over five months, peaking at 22.2% in August 2026.
- Phishing blocks per protected device rose 524% globally, with France seeing the sharpest increase at 159%.
- Surfshark expects phishing activity to surge further during the Black Friday shopping period.
TABLE OF CONTENTS
KEY HIGHLIGHTS
- A suspected fake TikTok Shop domain accounted for 19% of global phishing blocks (1.6 million) recorded by Surfshark between May and September 2026.
- Phishing blocks tied to the fake domain increased 638% over the same period, peaking at 22.2% of all blocks in August 2026.
- Total phishing blocks per protected device rose 524% globally, with France experiencing a 159% surge.
- Surfshark expects phishing activity to intensify during the Black Friday shopping period.
- NordVPN’s antivirus blocked 94% of phishing sites in recent tests, while Surfshark introduced post-quantum security for WireGuard.
A single domain’s outsized impact
Between May and September 2026, Surfshark blocked 320,017 phishing attempts tied to a suspected fake TikTok Shop domain, according to TechRadar. The domain accounted for 19% of the roughly 1.6 million phishing-category blocks recorded worldwide during this period. In August 2026 alone, it triggered 22.2% of all phishing blocks.
Phishing blocks surge globally
Monthly phishing blocks linked to the fake domain rose from 16,995 in May to 125,413 in September 2026, a 638% increase. By the first 20 days of October, the domain had already triggered 96,711 blocks.
Total phishing blocks per protected device jumped 524% globally between April and September 2026. The US saw a near sixfold increase, from 20,519 to 122,580 blocks. Europe experienced even sharper rises, with France leading at 159%, followed by Italy (99%), Spain (86%), the UK (54%), and Germany (38%).
Black Friday risks and security updates
Surfshark warned that phishing activity is likely to escalate during the Black Friday shopping period, as fraudsters exploit increased online traffic and consumer urgency.
Separately, NordVPN’s antivirus blocked 94% of phishing sites in AV-Comparatives’ latest test, while Surfshark recently introduced post-quantum security for its WireGuard protocol.
Related shifts in VPN and platform security
The phishing surge arrives as VPN providers expand their security features. Earlier reporting by LazyFounder noted that NordVPN’s Linux app update replaced OpenVPN XOR with the NordWhisper protocol and extended P2P support to all servers, signaling a broader industry push toward faster, more secure connections. Meanwhile, TikTok has faced scrutiny over content moderation and platform integrity, including a recent incident where the promotional account for the documentary Musk was suspended and later restored due to an "error."
What this means
Lazyfounder analysis — our interpretation, not reported fact.
The scale of this phishing campaign shows how quickly e-commerce fraud can concentrate around a single, believable fake domain. For founders and operators, it is a signal to audit security tools—not just VPNs but also payment gateways, customer support platforms, and supplier onboarding workflows—before the holiday shopping surge. The fact that 6% of phishing sites slipped past a top-tier antivirus in independent testing suggests that layers of detection (URL filtering, domain age checks, and transaction monitoring) are now table stakes. Operators running marketplace or social-commerce startups should also pressure-test their dispute resolution systems, as chargebacks and customer complaints will rise in lockstep with phishing.
Key takeaways
- A single fake TikTok Shop domain drove one in five global phishing blocks, demonstrating how fraudsters scale operations by impersonating trusted brands.
- Phishing exposure is rising fastest in Europe, with France, Italy, and Spain seeing the largest increases—key markets for cross-border e-commerce startups.
- Black Friday is likely to amplify phishing risks, requiring immediate updates to fraud detection and customer education workflows.
- NordVPN’s 94% phishing block rate in independent tests implies that 6% of threats still evade detection, underscoring the need for multi-layered security.
Related on Lazyfounder
Sources
- TechRadar · 2026-10-26
Fake TikTok Shops now fuel one in five phishing blocks — and Black Friday could make it worse
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
