app[.]tangempro[.]org

Analysis of app.tangempro.org indicates that the domain was registered on February 21, 2026 through Cloudflare, Inc. and is hosted on Cloudflare’s network (AS13335) with the IP address 104.21.72.243, geolocated to the United States. The domain resolves to the Cloudflare edge and presents an SSL certificate issued by Google Trust Services under the WE1 profile, confirming the use of reputable TLS infrastructure. Nameserver delegation points to betty.ns.cloudflare.com and mitch.ns.cloudflare.com, consistent with the registrar’s default configuration. The site’s sole observable page title is “Tangem”, and the underlying technology stack includes Cloudflare services and HTTP/3 support. VirusTotal scans have recorded six positive detections out of ninety‑three participating security vendors, indicating that multiple AV engines flag the domain as malicious.

The domain appears on a single external blocklist and has been actively blocked by the PhishDestroy mitigation service. The campaign is classified as a “Wallet/Seed Phishing” operation that impersonates the Binance brand, suggesting that threat actors aim to harvest cryptocurrency wallet credentials or seed phrases. Current status is listed as offline, which may reflect takedown or temporary suspension. No additional artifacts such as malicious payload hashes, phishing page screenshots, or redirect chains have been observed in the available data.

Consequently, the full extent of the phishing infrastructure, including any command‑and‑control servers or credential‑harvesting endpoints, remains uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering rules to include the exact host name, and monitor for any resurgence of the domain or related sub‑domains. Given the Cloudflare hosting, threat actors could rapidly redeploy a similar domain using the same registrar, so intelligence sharing with incident response teams and periodic re‑scanning of the host are recommended.