cybersecuritycybersecurity statistics

Fake TikTok shops fuel 19% of all phishing domain blocks

A recent investigation by Surfshark reveals a massive surge in global phishing block requests, driven largely by sophisticated scam operations, including counterfeit e-commerce shops. One domain stood out over the last 5 months and remains part of an active phishing scheme targeting TikTok Shop users. This reminds us to stay constantly vigilant while browsing online, as scams wait for unsuspecting visitors to fall into their traps at any moment.

Key insights

• Phishing activity intensified even as the number of protected devices expanded. Monthly phishing-category blocks grew more than sixfold, from 104,962 in April to 655,024 in September, a 524% rise. Over the same period, protected devices increased by 241%, while blocks per protected device rose from 0.74 to 1.35, an 83% increase. This means that growth in protected devices alone cannot explain the increase in blocked requests.

• Two separate scam operations using similarly structured hostnames led the data’s global rankings for six consecutive months. The April leader was linked to a fake cryptocurrency exchange, while the May–September leader was consistent with a counterfeit TikTok Shop ecosystem. Together, the two hostnames generated 333,117 blocks, equivalent to 18.6% of the 1,788,488 global phishing-category blocks recorded during the six-month period.

• The suspected counterfeit TikTok Shop-associated domain generated 320,007 blocks between May and September, accounting for 19.0% of all global phishing-category blocks during that five-month period. Its monthly blocks rose from 16,995 in May to 125,413 in September, a 638% increase. It accounted for 19.1% of September’s phishing blocks, after peaking at 22.2% in August, more than one in five blocks that month.

• The activity remained high in October. Preliminary data covering October 1–20 shows that the domain assessed as consistent with counterfeit TikTok Shop infrastructure remained the most-blocked phishing-category domain in the global data, generating 96,711 blocks and bringing its total since May to 416,718. It accounted for 18.1% of the 532,928 global phishing-category blocks recorded during the partial October period, compared with 19.1% in September.

• Phishing exposure rose across five major European markets, even after adjusting for growth in protected devices. Between April and September, blocks per protected device increased from 0.33 to 0.86 in France (+159%), 0.48 to 0.96 in Italy (+99%), 0.35 to 0.64 in Spain (+86%), 0.53 to 0.82 in the UK (+54%), and 0.34 to 0.47 in Germany (+38%). Italy recorded the highest September rate among these markets, followed by France and the UK.

• Generic, non-brand-specific phishing was visible across Europe. One verified phishing domain used generic-looking infrastructure with no identifiable impersonated brand and was reported alongside fake-unsubscribe infrastructure. It reached the monthly top five at least once in each of the five European markets analyzed. In August, it generated 6,748 blocks in the UK, accounting for 13.6% of all UK phishing blocks that month.

• US phishing exposure nearly doubled in six months. Blocked requests per protected device rose 87%, from 0.50 in April to 0.93 in September. Total phishing blocks grew nearly sixfold, from 20,519 to 122,580, while protected devices increased from 41,132 to 131,168, approximately 3.2 times, or 219%. The disproportionate growth means that the increase in blocked requests cannot be attributed solely to the expansion in protected devices.

Methodology

This analysis is based on aggregated data from Surfshark’s web content blocker between April and September 2026. It covers blocked requests categorized by the tool as phishing, the domains associated with those requests, and the monthly number of devices with phishing protection enabled worldwide.

Monthly exposure was calculated by dividing the total number of phishing-category blocks by the number of protected devices. Percentage changes were calculated using the underlying block and device counts; rates displayed in the text were rounded. Figures represent blocked requests, not unique attacks, domains, users, victims, or successful compromises. A single device may generate multiple blocked requests.

Domain rankings were based on the number of blocked requests associated with each domain during a given month. The leading domains were then manually investigated to determine their likely purpose and threat type. The phishing category may also include benign, advertising, tracking, adware, or potentially unwanted infrastructure, so individual domains were not described as confirmed phishing without additional verification.