helptangem[.]com

On July 25, 2026, the domain helptangem.com was observed serving a page titled “Tangem – Crypto Security Made Easy”. The title directly references the legitimate Tangem brand, indicating an attempt to masquerade as the crypto‑hardware wallet provider. The site was hosted behind Cloudflare, using the nameservers benedict.ns.cloudflare.com and elinore.ns.cloudflare.com, and responded over HTTP/3 with an hCaptcha challenge. The TLS certificate was issued by Google Trust Services under the WE1 root, confirming a legitimate certificate chain but offering no guarantee of benign intent. DNS resolution pointed to IP address 104.21.39.146, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States.

The domain was registered on 29 October 2025 through NiceNIC International Group Co., Limited. When accessed, the server returned HTTP 404, and the site has since been taken offline. Reputation services have flagged the domain: it appears on one security blocklist and has been blocked by PhishDestroy. VirusTotal analysis recorded detections from three of ninety‑five scanners, reinforcing the suspicion of malicious use.

No additional public intelligence, such as OTX tags or Safe Browsing entries, is presently available. The combination of a brand‑specific page title, legitimate‑looking SSL, and use of a reputable CDN suggests a classic credential‑harvesting setup that leverages trust in the Tangem name. Defenders should immediately block helptangem.com at network perimeter and endpoint filters, monitor DNS queries for the domain and its associated IP, and consider adding the IP address 104.21.39.146 to block lists, keeping in mind that Cloudflare may host many unrelated sites on the same address. Continuous re‑evaluation of the domain’s status is advised, as the offline state could be temporary and the infrastructure may be repurposed for future campaigns.