Is tangentwaves.com a scam? TrustSniffer's high-risk assessment: 5/100

Security Alert

Fortinet, Sophos flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

Tangent Waves presents itself as a Nepal-based business consultancy serving startups, entrepreneurs, small businesses, and organizations through business development, resilience support, customized training, bootcamps, mentoring, events, and a “Book Our Services” call to action. Its apparent business model is fee-based professional consulting and training rather than an account-driven or transactional online platform.

Scam/Impersonation Risk

The site’s stated consultancy purpose and captured pages do not display obvious credential-harvesting, payment, wallet, or login functionality, and no brand impersonation or conflicting legal identity was identified. However, this benign page presentation is outweighed by confirmed external threat indicators: the domain is blacklisted by multiple listed sources, and fifteen evaluated detections classified it as malicious, with two additional suspicious detections. This is a direct contradiction to the otherwise ordinary corporate presentation and supports a critical interaction-risk posture. The site’s historical presence is substantial, but that continuity does not neutralize the current reputation findings. Evidence:

• External reputation assessment recorded a confirmed blacklist with sources identified as VT and EXTERNAL_BLACKLIST.
• Fifteen malicious and two suspicious detections were recorded across the evaluated external reputation checks; Fortinet and Sophos were among the flagged vendors.
• Archive records show 747 snapshots spanning 2013–2026, covering 14 tracked years, with first observation on 2013-02-12 and latest observation on 2026-08-15.
• The homepage capture presented consultancy content without a login form, hidden sensitive form, wallet connection, or password submission flow.

Regulatory Verification Notes

The site describes professional services and publishes an address, telephone contact, service descriptions, testimonials, events, and an “About Us” section, but the supplied content does not show a licensing authority, registration number, or independently verified operating entity. The site’s real-world operator therefore remains unverified, and its identity claims should not be treated as independently established. The absence of a broker-dataset match is only contextual and does not establish licensing or regulatory standing. Evidence:

• The homepage and service pages identify business development, customized training, bootcamps and accelerators, mentoring, resilience support, and events as core offerings.
• The contact and corporate-content pages provide an address and telephone details but no supplied license number or licensing authority.
• The site’s transport encryption uses a DV certificate issued by YR1, valid to 2026-11-07.

What to Verify Next

Before any engagement, an independent party should confirm the consultancy’s legal existence, responsible principals, physical operating details, and any applicable Nepalese business or training-sector registration through authoritative registries rather than relying solely on the website. Contact details should be validated through an independently sourced channel, and any proposed service agreement should identify the contracting entity, refund terms, deliverables, payment recipient, and dispute mechanism. Given the external threat findings, credentials, sensitive documents, and financial information should not be submitted unless those checks produce clear, independently corroborated results. Evidence:

• Identity verification is recorded as unverified, with no independent identity signals supplied.
• The on-page disclosure state is unclear, while the business model is described as paid consultancy, training, mentoring, bootcamps, and events.
• The captured site contains no login form, sensitive form, or payment flow, so prospective engagement would require separate off-site contracting and payment checks.

Summary Verdict

The website has a plausible consultancy presentation and a long technical and archival presence, but those positive characteristics are decisively outweighed by confirmed blacklist status and multiple malicious external detections. The resulting posture is critical interaction risk, with legitimacy appearing unverified rather than established.

Infrastructure Integrity

The site resolves directly to a single likely origin rather than a CDN edge, with no CDN or WAF identified. It is hosted on AS31898, ORACLE-BMC-31898 operated by Oracle Corporation in the United States; this is a hosting fact and provides no independent assurance regarding the site operator. Evidence:

• Hosting infrastructure resolved to AS31898, ORACLE-BMC-31898 – Oracle Corporation, US.
• The resolved address was 192.185.137.139, with one unique address and one likely origin address identified.
• No CDN, WAF vendor, or edge-IP layer was detected.

Closing Assessment

The appropriate institutional posture is to suspend credential, document, and financial interactions until independent identity, registration, and threat-reputation checks are satisfactorily resolved; any engagement should be limited to controlled, non-sensitive inquiry during that process.