Fake TikTok Shops now fuel one in five phishing blocks — and Black Friday could make it worse

A single domain linked to a suspected counterfeit TikTok Shop operation became an unusually large source of phishing activity. Surfshark recorded 320,007 blocks connected to it between May and September 2026. That represented 19% of about 1.6 million phishing-category blocks worldwide. The scale matters because one fake storefront accounted for nearly one in every five blocked phishing attempts.

The domain’s activity rose sharply during the period. Monthly blocks increased from 16,995 in May to 125,413 in September. The domain reached its largest share in August, when it represented 22.2% of all phishing blocks. Surfshark said users were being rerouted to fraudulent stores designed to steal money and personal information.

The operation remained active in October. During the first 20 days of that month, the same domain triggered another 96,711 blocks. Its growth occurred alongside a broader phishing spike, with total category blocks rising 524% between April and September. The figures suggest fake shopping sites were a major part of the wider threat before Black Friday.

Phishing is a form of online deception that tries to make someone hand over sensitive information or money. The attacker presents a fake site, message, or service as trustworthy. In this article, the suspected operation used a counterfeit shopping storefront. The danger is that a shopper may believe they are buying a genuine product when they are actually dealing with a fraudulent site.

A fake shop can copy familiar branding, product pages, prices, and checkout screens. It may ask for a card number, billing details, login information, or contact details. When a shopper enters them, the operator can capture the information instead of processing a legitimate purchase. The article describes these stores as designed to steal money and personal information rather than sell genuine products.

Phishing blocks show that security tools detected and stopped visits to suspicious destinations. Surfshark recorded 320,007 blocks tied to one suspected domain. That figure shows the attempted reach of the operation, not necessarily the number of successful victims. Shoppers should verify a store before entering payment information, especially during major sales.

Phishing exposure expanded dramatically during the period covered by Surfshark’s data. Total phishing-category blocks rose 524% between April and September. Blocks per protected device also increased 83%, showing that the growth was not explained only by more people using Surfshark’s protection. The increase points to more suspicious activity reaching protected users.

The suspected fake TikTok Shop domain accounted for 320,007 blocks between May and September 2026. That was 19% of roughly 1.6 million phishing-category blocks worldwide. Its monthly total rose from 16,995 in May to 125,413 in September. In August, it made up 22.2% of all phishing blocks.

Exposure rose in several countries as well. Between April and September, blocks per protected device increased 159% in France, 99% in Italy, 86% in Spain, 54% in the UK, and 38% in Germany. In the US, exposure rose 87%, while total blocks climbed from 20,519 to 122,580.

Busy shopping periods create a larger audience for fraudulent storefronts. Black Friday brings shoppers who are actively searching for discounts, products, and limited-time deals. That urgency can make people click quickly or overlook warning signs. A fake store therefore has more opportunities to attract visitors when shopping activity is unusually high.

The article links this risk to the suspected TikTok Shop operation and the wider phishing surge. One domain produced 320,007 blocks between May and September, while total phishing-category blocks rose 524% between April and September. Surfshark expects phishing activity to rise again as Black Friday approaches. Fake shops can benefit from shoppers following promotional links or reacting to redirects without checking the destination.

The recommended response is to slow down before paying. Shoppers should confirm that a site is official, type a trusted address manually when a redirect looks suspicious, and ignore promotional links sent by SMS or messaging apps. Single-use virtual cards can also reduce exposure if payment details are stolen.

In this article, a phishing block is a visit or connection that Surfshark’s web content blocker identifies as belonging to the phishing category and stops. The data counts blocked activity, such as attempts to reach the suspected fake shop domain. It does not count only people who completed purchases or submitted personal information.

For example, the domain triggered 320,007 blocks from May through September. A user may have clicked a link, followed a redirect, or opened a suspicious page before the blocker stopped access. The tool can block site categories, including phishing, even when the VPN is switched off. That makes the figure useful for measuring detected exposure to the domain.

A blocked attempt is not proof that someone became a victim. The protection may have interrupted the visit before the shopper saw the page or typed card details. The article gives no victim total. Its figures show attempted or detected contact with a suspected fraudulent destination, rather than confirmed financial losses.

The safest first step is to verify the store before opening its checkout. The article recommends checking that every site is official. If a redirect looks suspicious, shoppers should type a trusted address manually instead of continuing through the redirected page. This removes one common route to a counterfeit storefront and gives the shopper a chance to confirm the destination.

Shoppers should also ignore promotional links sent by SMS or messaging apps. Those links can lead directly to fraudulent stores or suspicious redirects. A security tool can provide another layer of protection by blocking phishing categories. Surfshark’s web content blocker, for example, can block those categories even when the VPN is switched off.

Payment choice matters too. The article recommends single-use virtual cards. These can limit the usefulness of payment details if a fake checkout captures them, because the number is intended for one transaction. No tool replaces careful checking, but using a verified address and a disposable payment method reduces the information exposed to a suspected fake shop.

A fake storefront works by making an unsafe destination look normal and trustworthy. It can present products, prices, branding, and checkout pages in the style of a legitimate retailer. That familiar design lowers suspicion. The article warns that users may be unknowingly rerouted to fraudulent stores designed to steal money and personal information rather than sell genuine products.

The route to the store can also be disguised. A shopper might follow a promotional link from an SMS or messaging app, or continue after a redirect that changes the destination. Once there, the site can use a convincing checkout request to prompt card details and other personal information. The article specifically advises typing a trusted address manually when a redirect looks suspicious.

These tactics rely on people trusting appearance, urgency, or the message source instead of checking the final site. The suspected domain generated 320,007 blocks from May through September, showing how widely such traffic was detected. As Black Friday approaches, shoppers should verify official sites and avoid untrusted promotional links.