tiktok.yalmy.shop is a scam: the brand in the subdomain, the romance hook and the 27,000 euro

Disclaimer: we are a law firm dealing exclusively with online fraud and unauthorised financial activity. This article arises from a real case handled by the firm and is published in anonymised form as regards the injured party, for public-interest purposes. If what you read sounds familiar, you can submit your case through the form at the bottom of this page.

Some scams can be identified from the link alone. tiktok.yalmy.shop is one of them, and almost nobody looks at the link.

tiktok.yalmy.shop is a scam: it is not a TikTok service, it is not an investment platform, it is not an authorised intermediary. It is an address registered by third parties that exploits a technical detail which the vast majority of people are unaware of. Our firm has already handled this case — 27,000 euro paid out during October 2026 — and in this article we explain why that link alone was enough to expose everything.

Why tiktok.yalmy.shop is a scam: the part of the link nobody reads

Let us start with the single most important lesson of the whole case, one that matters to anyone reading even if they have not lost a cent.

In a web address the name that counts is not the first one, it is the last one before the extension. In tiktok.yalmy.shop the actual domain is yalmy.shop. The word "tiktok" preceding it is merely a subdomain: a label that whoever registered yalmy.shop can write as they please, without asking anyone's permission and without any form of control.

Anyone who registers a domain can create, in thirty seconds, subdomains called tiktok, amazon, your bank's name, an exchange's name, anything at all. No authorisation is required, no relationship with the brand is required, and it costs nothing. That is why tiktok.yalmy.shop is a scam in its very structure: the world-famous brand sits in the decorative part of the address, while the part that actually identifies who runs the site — yalmy.shop — tells nobody anything whatsoever.

The practical rule to take away, and to teach your family, is this: read the address from right to left. Start at the extension, take the name immediately before it, and that is the owner. Everything to the left of that name was written by them. If the brand you expect is not that name, you are not on that brand's website.

Whoever built tiktok.yalmy.shop chose a .shop extension, not the most closely policed, and placed on top of it the name of a social network everybody knows. The result is an address which, read quickly on a phone screen, looks like an official service. It never was one.

tiktok.yalmy.shop no longer exists: what the technical check shows

The checks we carried out on the domain of tiktok.yalmy.shop tell the second half of the story.

As at the date of this article, querying the authoritative servers of the .shop extension for yalmy.shop and for tiktok.yalmy.shop returns NXDOMAIN: the name does not exist in the zone. Querying the competent registry through the RDAP protocol returns 404: no registration record. There are no A records, no MX records, no nameservers.

Translated: the domain behind tiktok.yalmy.shop has been deleted. The injured party's payments date from late October 2026. Within a few weeks the infrastructure was dismantled and the name left the registry.

This is not a bureaucratic detail, it is an item of evidence. A company carrying on lawful business does not make its own domain evaporate two weeks after collecting payment. The register-collect-delete cycle is the operational signature of those who set up disposable infrastructure, and the speed of the deletion here is remarkable.

There is also a procedural consequence that must be stated clearly, because it is the only reason it makes sense to move immediately. Even where a domain has been deleted, the registrar retains the registration data: who registered it, with which email address, with which payment method, from which IP address, and which other domains sit in the same account. This information is not public and cannot be obtained by searching the internet: it can only be obtained through a judicial request to the registrar, and retention periods are not indefinite. The more time passes since the deletion of tiktok.yalmy.shop, the more this avenue closes.

Add a figure that says a great deal: there is no public trace of tiktok.yalmy.shop at all. No reviews, no forum reports, no archived copy. This was not a site seeking visibility: it was a private address, shown one by one to people already hooked elsewhere.

The hook: romance baiting leading to investment

The mechanism by which people reach tiktok.yalmy.shop is not advertising. It is a relationship, and this is the second reason why tiktok.yalmy.shop is a scam that is hard to recognise from the inside.

In the case we handled, the injured party summed it up with a clarity worth reporting: this was romance baiting designed to lead into investments. First the relationship forms — weeks of daily messages, confidences, plans. Then, once trust is built, the investment arrives: shared, presented as an opportunity to seize together, not as a commercial proposal.

This pattern has a name in international practice and is today the most profitable form of online fraud. It works because it does not attack the wallet, it attacks the relationship. The person investing is not assessing a financial product: they are placing trust in a person. And from the inside, the victim is not performing a reckless operation: they are making an ordinary gesture towards someone they trust.

That is why questions of the "how could you not notice" variety are wrong and, above all, useless. The lever was not greed: it was affection.

There is also, in our file, an element rarely found and worth reporting. In one of the final conversations, the person who had run the hook described the organisation from the inside: operators recruited in several countries to supply the voices, and separately a woman — said to be resident in the United Kingdom — who supplied the videos and photographs of the character. Faces and voices, therefore, belonged to people other than whoever was writing.

Two practical consequences.

The first concerns the person in the photographs. In the vast majority of cases she too is a victim: images taken from her own profiles and reused without her knowledge, or videos generated artificially from those images. She should not be identified as responsible: she should be treated, where possible, as a further injured party, because the use of her face to deceive amounts to identity impersonation under art. 494 of the Italian criminal code to her detriment.

The second concerns the structure. A division of tasks across several countries — who speaks, who supplies the face, who runs the accounts, who runs the site — is not compatible with the action of a single individual. This element should be deployed in the complaint to seek investigation also under the heading of criminal conspiracy under art. 416 of the Italian criminal code, and to press for linkage with other pending proceedings arising from the same matrix.

Where the 27,000 euro went: three different routes

The payments documented in the file on tiktok.yalmy.shop did not all go to the same place, and that is technically good news.

Part went to the injured party's own account at a regulated cryptocurrency exchange established in an EU Member State. An instant transfer of 2,000 euro on 28 October 2026 and one of 7,200 euro, both to positions held in her own name. The money was then converted into cryptocurrency and transferred to a wallet indicated by the fraudsters.

Part went to a natural person's account at an electronic money institution authorised in Lithuania: 3,000 euro on 30 October 2026, with a Lithuanian IBAN, an individual account holder with a residential address in Slovakia. And, above all, with a declared payment purpose: "family support".

Let us pause on that purpose, because in the case of tiktok.yalmy.shop it is the single most eloquent datum in the whole file.

No investment anywhere in the world is paid for with the reference "family support". That wording is not an error and not sloppiness: it is an operational instruction. It is designed to carry the transfer past the automated anti-money-laundering screening of the ordering bank and the receiving institution, because a transfer between private individuals for family support is statistically innocuous, whereas a transfer to a private individual marked "investment" triggers an alert immediately.

Whoever dictated that wording knew exactly what they were doing. And whoever made the account available to receive it cannot credibly claim to have been unaware of the provenance, which opens the way to money laundering under art. 648-bis or, depending on the position, self-laundering under art. 648-ter.1 of the Italian criminal code.

We do not publish here the account holder's name or the full IBAN, for a specific reason: a person who lends an account is very often someone recruited through a bogus job advertisement, or indeed a victim of identity theft. Their position must be established individually by the authorities, and the proper route is a filed complaint, not publication.

Paying into your own account does not mean losing the trail

A mistaken belief needs correcting here, one that paralyses many of the people who paid into tiktok.yalmy.shop: "I sent the money to myself and then moved it on myself, so it is my fault and nothing can be done".

The opposite is true, and in the tiktok.yalmy.shop case it is the strongest feature of the file.

Anyone who transferred to their own account at a regulated exchange left behind them the most complete evidential chain one could wish for: a traced bank transfer out, an identity-verified account in, a recorded conversion into cryptocurrency, and finally an outgoing transfer to a destination address which is known, because it appears in your own transaction history.

That destination address is the real starting point of the investigation. A blockchain is not deleted and not dismantled like a domain: every subsequent movement remains visible to anyone who can read it, and analysis allows the funds to be followed to the point where they enter an exchange — where there is an identified holder and a judicial order can reach.

Anyone who has suffered the tiktok.yalmy.shop scam must therefore retrieve from their exchange account, before anything else, the complete list of outgoing transactions with destination addresses and hashes. It is the single most important document in the file. And not the hardest to obtain: you download it yourself, in minutes.

On the regulatory side, a platform presenting itself as offering crypto-asset investment and portfolio management without any authorisation operates in breach of Regulation (EU) 2023/1114 and of the Italian implementing provisions in legislative decree 129/2024, as well as committing the unauthorised financial activity offence under art. 166 of the Italian consolidated financial act. For tiktok.yalmy.shop there is no VAT number, no company name, no registered office, no corporate reference, no entry in any register: there was nothing to authorise, because there was no entity.

Instant transfers: what is possible and what is not

The unfavourable part must be stated honestly too, because wrong expectations waste time.

The payments in the tiktok.yalmy.shop case were made by instant transfer. An instant transfer is by its nature irrevocable: settlement is final within seconds and there is no recall procedure comparable to that available for an ordinary transfer in the first hours.

Nor can the protection provided for unauthorised payment transactions be invoked: that regime covers someone debited for an operation they never ordered, whereas here the order was given by the injured party — deceived as to the reasons, but aware of the act. Promising a refund by that route would be an illusion.

What is concretely possible is something else: obtaining the documentation held by the banks and institutions involved — including any suspicious transaction report the intermediaries are required to file — identifying the holder of the receiving account at the Lithuanian institution, and following the cryptocurrency chain to a seizable point. The receiving electronic money institution is established within the European Union: it is therefore reachable by European Investigation Order, with no letters rogatory, and is required by law to retain the holder's identification data.

Facts of October 2026: the aggravating circumstance applies, but the complaint deadline is running

Two time coordinates govern the drafting of the complaint in the tiktok.yalmy.shop case, and here they point in opposite directions.

The first is favourable. The facts are from October 2026, hence after the entry into force of law 90/2024: art. 640 paragraph 2-ter of the Italian criminal code applies in full, aggravating fraud committed remotely by means of computer tools capable of hindering identification of the perpetrator. That is precisely this case: a constructed identity, a domain registered to nobody and since deleted, a conduit account in a third country, and a final destination in cryptocurrency.

To this are added the aggravating circumstance of diminished defence under art. 61 no. 5, recalled by art. 640 paragraph 2 no. 2-bis — particularly apt here, because the simulated emotional relationship is precisely the circumstance of person the perpetrator took advantage of — and that of particularly serious financial loss under art. 61 no. 7.

The second coordinate is a deadline running now. Simple fraud is prosecutable on complaint filed within three months of knowledge of the fact. With payments made in late October 2026, that deadline falls at the end of January 2027. The aggravating circumstances in the second paragraph of art. 640 entail prosecution of the court's own motion, and unauthorised financial activity under art. 166 of the consolidated financial act is prosecutable ex officio in any event: but building the file on ex officio prosecution to cure a late complaint is a weak choice when filing in time is perfectly possible.

Anyone who paid into tiktok.yalmy.shop in recent weeks therefore faces a window that is not long. And it is the same window in which the registrar's data and the receiving institution's records are still fresh.

Contact is still open: what to do and what not to do

In the tiktok.yalmy.shop case the injured party, at the first interview, had not closed the channels of communication with the organisation. An instinctive and understandable choice, to be managed with judgement.

Keeping the chat open has value: conversations are evidence, and an organisation that keeps writing keeps producing usable material. But there are three non-negotiable rules.

Not another cent is sent, in any form and for any stated reason. After the final payment there always come demands to unblock the account, pay the percentage, pay the tax, cover the exit commission. All of them are false: no payment releases funds that do not exist. We documented this in the case of eliteclouds.com and in that of axi24-cfd.com.

The complaint is not announced and the counterparty is not confronted with the evidence gathered. Anyone forewarned moves the funds and closes the accounts within hours.

Nothing is deleted. Conversations must be exported natively, not screenshotted: a native export preserves numbers, timestamps and media file identifiers. The numbers used, the accounts, and the images and videos received must be kept — those files carry metadata, and artificially generated videos leave traces recognisable to technical analysis.

To this must be added a near-certain warning. After a scam like that of tiktok.yalmy.shop, within a few weeks come the calls from those offering to recover the capital: self-styled fund recovery firms, bogus officials, bogus lawyers, in some cases people posing as staff of public offices. They know how much you lost and when, because that data comes from the original fraud. It is a separate offence, and we analysed it in dam.w24platform.com.

Serious recovery runs through the judicial authority and seizure. There is no other route, and anyone promising one is part of the problem.

What to secure immediately

Anyone who paid into tiktok.yalmy.shop should secure receipts and confirmations for every transfer, with full beneficiary details, IBAN, BIC, country and payment reference: the reference must be preserved with particular care. The complete list of operations on your exchange account, with destination addresses and transaction hashes. A native export of all conversations, with numbers and dates. The images and videos of the character, in their original files. Every screenshot of the platform, the dashboard and the balances displayed. The exact address of the platform, in its complete form.

On that basis a complaint is drafted alleging aggravated fraud under art. 640 paragraphs 2 no. 2-bis and 2-ter, with the aggravating circumstances under arts. 61 nos. 5 and 7, identity impersonation under art. 494, money laundering under art. 648-bis in relation to the receiving account, unauthorised financial activity under art. 166 of the consolidated financial act and breach of the crypto-asset rules, with a request for investigation under art. 416. Together with applications for acquisition of the domain registration data from the registrar, acquisition of records from banks and institutions, identification of the receiving account holder by European Investigation Order, analysis of the cryptocurrency chain, and seizure.

Similar cases already handled by the firm

Anyone affected may find useful our analyses of qwoxak, on hooking through a dating app, of capitagains, of cryptop.market, of artisanworks.vip on very short-lived domains, and our study of unauthorised financial activity.

If you invested on tiktok.yalmy.shop: what to do now

The picture is this. tiktok.yalmy.shop is a scam built on a subdomain displaying a brand it has no connection with, resting on a domain that has since been deleted and carries no corporate reference whatsoever, fed by a romance hook and by a structure with tasks split across several countries, collecting partly into a private individual's account at a foreign institution under a false payment reference and partly in cryptocurrency to a wallet.

The facts are very recent, and that is the best possible starting point: the registrar's data is still retrievable, the receiving account is within EU territory, and the cryptocurrency chain is still short. But the complaint carries a three-month deadline, and for facts of October 2026 that deadline is running now.

Our firm has already handled this case and knows this matrix. You can submit your position for a preliminary assessment.

If you have suffered the same scam, we can help you. Fill in the form at the bottom of this page.