- Surfshark data shows blocks of a single suspected fake TikTok Shop domain rose 638% between May and September.
- The domain was behind roughly one in five phishing blocks worldwide and is still active in October.
- Phishing exposure also climbed across Europe and the US, with France seeing the sharpest rise.
New data from Surfshark shows that a single domain linked to a suspected counterfeit TikTok Shop operation generated 320,007 phishing blocks between May and September 2026.
That's 19% of the roughly 1.6 million phishing-category blocks recorded worldwide by the company's web content blocker over those five months. The operation isn't slowing down either: in the first 20 days of October, the domain triggered another 96,711 blocks.
The findings come weeks before the busiest shopping period of the year. They're also a reminder that even the best VPN can only do so much if you type your card details into a convincing fake.
One fake storefront, a fifth of all phishing blocks
Monthly blocks tied to the domain jumped from 16,995 in May to 125,413 in September, peaking at 22.2% of all phishing blocks in August.
It's part of a much broader spike. Total phishing-category blocks rose 524% between April and September, and blocks per protected device climbed 83%, so the growth isn't just down to more people using the tool.
"Data clearly shows users are being unknowingly rerouted to fraudulent stores designed to steal money and personal information rather than sell genuine products," said Justas Pukys, Senior Product Manager at Surfshark.
Phishing exposure rises across Europe and the US
Between April and September, blocks per protected device rose 159% in France, 99% in Italy, 86% in Spain, 54% in the UK, and 38% in Germany.
In the US, exposure nearly doubled. Blocks per protected device rose 87%, while total phishing blocks grew almost sixfold, from 20,519 to 122,580.
How to stay safe this Black Friday
Surfshark expects phishing to rise again as Black Friday approaches. Pukys recommends checking that every site is official, typing a trusted address manually if a redirect looks suspicious, and ignoring promotional links sent by SMS or messaging apps. He also suggests paying with single-use virtual cards.
Security tools can help catch what you miss. Surfshark's own web content blocker, the tool behind this data, lets you block site categories, including phishing, even with the VPN switched off. NordVPN's next-gen antivirus blocked 94% of phishing sites in AV-Comparatives' latest test, and VPN providers are hardening connections too, with Surfshark recently bringing full post-quantum security to WireGuard.