tcgpark-eu[.]io

This domain, tcgpark-eu.io, is identified as a crypto drainer phishing site targeting users of trading card game (TCG) platforms. Analysis of the page title, "TCG Park," and associated infrastructure indicates an attempt to impersonate legitimate TCG marketplaces, likely to harvest login credentials and drain cryptocurrency wallets. The site employs a combination of modern web technologies, including Vue.js and Cloudflare, to enhance functionality and evade detection, while the presence of HSTS suggests an effort to appear secure despite malicious intent.

Technical indicators confirm elevated risk: the domain was registered on March 04, 2026, through Dynadot LLC, an uncommon future date that may indicate typosquatting or domain squatting. It resolves to the IP address 104.21.3.80, a Cloudflare-hosted endpoint, which is frequently leveraged to obscure origin servers. VirusTotal detection metrics show 2 out of 95 security vendors flagging the domain, while it appears on three independent security blocklists. The SSL certificate is issued by Google Trust Services, adding a layer of apparent legitimacy, though this is a common tactic among phishing operators. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification.

As of the latest assessment, tcgpark-eu.io has been taken offline, likely in response to blocklist inclusion and detection by multiple security mechanisms. However, residual risk persists due to the domain's registration remaining active, allowing for potential reactivation or migration to alternative infrastructure. Users who interacted with the site are advised to revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations should update blocklists to include this domain and its associated IP to prevent future exposure.