colorcrafters[.]site

Analysis of the domain colorcrafters.site shows that it was registered on February 21, 2026 and subsequently resolved to the IP address 172.67.180.247, which is owned by Cloudflare, Inc. (AS13335) and geolocated to the United States. The site presented the page title "Tangem Help Center," indicating an attempt to impersonate a legitimate support portal for the Tangem brand, although the content of the page has not been captured for further inspection. The domain is currently offline, and its risk level is marked as under investigation.

The infrastructure was flagged by the PhishDestroy blocklist and appears on one additional security blocklist, confirming that external threat‑intelligence feeds have identified it as malicious. A VirusTotal scan involving 93 antivirus engines was performed, and none of the engines raised a detection; however, the absence of detections does not constitute a safety guarantee. The SSL certificate associated with the domain is identified as WE1, suggesting the use of a publicly available certificate rather than a proprietary or brand‑specific credential.

No further evidence such as Safe Browsing alerts, OTX identifiers, or additional blocklist entries was supplied. Given the domain’s recent creation, its association with a known phishing‑related blocklist, and the impersonation implied by the page title, defenders should continue to monitor the domain for any re‑activation, block network traffic to the IP address 172.67.180.247, and consider adding the domain to internal deny lists. Ongoing investigation should focus on capturing the actual landing page content, verifying any credential‑harvesting forms, and correlating any observed phishing campaigns that reference the Tangem brand.