tangem-wallet[.]cc

Analysis indicates that the domain tangem-wallet.cc was registered on August 04, 2026 through Gname.com Pte. Ltd. and currently resolves to the IP address 104.21.88.165. The domain appears on three independent security blocklists, and three of ninety‑one VirusTotal scanners have flagged it as malicious. Additional protective services, including PhishDestroy, MetaMask and SEAL, have listed the domain as blocked, reinforcing the assessment that it is being used as a crypto drainer. The threat type is explicitly identified as a crypto drainer, meaning the infrastructure is likely employed to lure cryptocurrency users into submitting private keys or signing malicious transactions, resulting in asset loss.

Infrastructure analysis reveals a single hosting endpoint, suggesting a low‑profile deployment that may be shared with other illicit sites. No public SSL certificate details, HTTP response codes, or page title information are available at this time, limiting visibility into the exact content served. The presence on multiple blocklists and the detection by several VirusTotal engines provide concrete evidence of malicious intent, while the lack of broader telemetry leaves open questions about the scale of victim outreach and any additional supporting infrastructure.

Defenders should add tangem-wallet.cc to deny‑list rules across DNS filtering, proxy, and endpoint protection solutions. Monitoring of traffic to 104.21.88.165 for anomalous connection patterns is advised, as is the implementation of user awareness campaigns that warn against unsolicited requests for wallet credentials. Continued observation of the domain’s status on blocklists and any future VirusTotal scans will help refine the risk posture.