tangiking[.]org

Analysis shows that tangiking.org resolves to IP 217.194.134.12, hosted in the United States under AS133199 SonderCloud Limited. The domain is registered with GoDaddy.com, LLC and was created on December 07, 2024. Infrastructure observations include an active Nginx server returning HTTP 200, a valid Let's Encrypt R13 certificate, and the presence of front‑end libraries such as Bootstrap, jQuery, Highlight.js, Reveal.js, and jsDelivr, alongside HSTS enforcement. Threat intelligence indicates the domain is listed on PhishDestroy and appears on one additional security blocklist. VirusTotal scans report five out of ninety‑one vendors flagging the domain, and AlienVault OTX references it in fourteen threat pulses. Gridinsoft assigns a trust score of 0 out of 100, underscoring the high risk classification. Nameservers ns25.domaincontrol.com and ns26.domaincontrol.com are active. Content of the site has not been publicly analyzed, so the exact phishing payload remains unknown. Defenders should immediately block the domain and its associated IP at perimeter and DNS layers, monitor for any outbound connections to the host, and consider sinkholing the IP range if feasible. Ongoing surveillance of related indicators, including the identified technologies and the registrar’s name servers, is recommended to detect potential re‑use or migration of the malicious infrastructure.