dexspace[.]ai

This domain, dexspace.ai, is flagged as a high-risk brand impersonation threat specifically targeting Telegram users. Analysis indicates the domain was designed to deceive victims by mimicking official Telegram branding, likely to facilitate credential theft, fraudulent transactions, or malware distribution. The page title 'Green Initiative' suggests an attempt to lend legitimacy to the operation, potentially leveraging environmental or social themes to lower user defenses. Infrastructure analysis reveals the domain was registered through Immaterialism Limited on March 02, 2026, and resolves to the IP address 188.114.96.3. It is detected by 12 out of 95 security vendors on VirusTotal, while Gridinsoft and Scamadviser assign trust scores of 0/100 and 16/100, respectively. The domain appears on three security blocklists and is actively blocked by MetaMask, PhishDestroy, and SEAL. Technologies detected include Cloudflare, Cloudflare Browser Insights, and HTTP/3, which may be used to obfuscate malicious activity or enhance performance. Google Safe Browsing has flagged the domain with the label 'SOCIAL_ENGINEERING,' confirming its use in deceptive practices. Mitigation for this threat type requires immediate action from security teams and end-users. Organizations should ensure the domain and its associated IP (188.114.96.3) are blocked at the network perimeter, including firewalls, DNS filters, and email gateways. End-users should be educated on recognizing brand impersonation tactics, particularly those involving messaging platforms like Telegram. Security teams are advised to monitor for indicators of compromise (IOCs) such as the domain, IP, and any associated URLs or files distributed via this campaign. If the domain was accessed, affected systems should be isolated, credentials reset, and logs reviewed for unauthorized activity. Given the domain's current offline status, continuous monitoring is recommended to detect potential re-emergence or related infrastructure.