tangerineai[.]space

PhishDestroy identifies tangerineai.space as a recently active domain suspected of hosting a generic phishing campaign aimed at cryptocurrency theft. The domain lacks association with any legitimate brand, suggesting it may be part of a broader crypto drainer operation. While specific drainer kits or targeting mechanisms remain unverified at this stage, the absence of a recognizable brand name or service affiliation raises immediate concerns about its intent to deceive users into transferring funds to attacker-controlled wallets. This domain was flagged on April 16, 2026, and resolves to IP 188.114.96.3. It is registered under HOSTINGER operations, UAB and secured with a Let's Encrypt SSL certificate. VirusTotal currently shows 0 detections out of 95 engines, indicating a low detection rate despite potential malicious activity. No entries were found in Google Safe Browsing (GSB) or common blocklists as of this report, which may suggest either evasion tactics or a recently deployed infrastructure. The young domain age and lack of web content further imply a testbed or staging environment for phishing operations. The current status of tangerineai.space remains under investigation, with no confirmed reports of successful compromises at the time of writing. However, the lack of detections and absence from blocklists suggest this domain may pose an emerging threat to cryptocurrency users. PhishDestroy recommends immediate blocking of this domain at the network level and advises caution when receiving unsolicited links or QR codes related to crypto transactions. Regular monitoring of this domain and its associated infrastructure is advised, as attackers may escalate operations or pivot to more sophisticated lures. Users should rely on verified sources and multi-factor authentication to mitigate risks associated with crypto drainer phishing campaigns.