tangemrestorationapp[.]speedcarrierway[.]com

The domain tangemrestorationapp.speedcarrierway.com was observed in a brand‑impersonation campaign targeting Discord users. Registration data indicate the domain was created on 3 July 2025 through NameSilo, LLC, and it resolves to the IPv4 address 45.84.206.4, which is announced by AS47583 belonging to Hostinger International Limited and geolocated to Lithuania. The hosting provider does not present a valid SSL certificate, and HTTP requests return a non‑secure response. The authoritative nameservers listed are byte.dns-parking.com and pixel.dns-parking.com, both typical of parking services. The page title returned by the server is “Tangem – Your Secure Hardware Wallet”, matching the declared scam type of wallet/seed phishing, although the brand target recorded in threat intelligence is Discord. This mismatch suggests the operator may be reusing a previously compromised or purchased domain to lure victims with a hardware‑wallet narrative while harvesting Discord credentials or seed phrases.

VirusTotal analysis shows that one of ninety‑five scanning engines flagged the domain, and Gridinsoft assigned a trust score of zero out of one hundred, indicating a high likelihood of malicious intent. The domain appears on a single external blocklist and has been added to the PhishDestroy blocklist, leading to its current offline status. No additional public threat‑intel feeds (OTX, Safe Browsing) are referenced in the supplied data. Uncertainty remains around the exact content served when the site was live; the available evidence does not include a snapshot of the HTML or any credential‑capture forms. Consequently, defenders cannot confirm whether the page displayed a Discord login prompt, a Tangem wallet interface, or a hybrid lure.

The presence of a Discord impersonation tag, combined with a wallet‑related page title, points to a possible multi‑brand phishing vector. Mitigation guidance: network defenders should block any outbound connections to 45.84.206.