tespace-xmine[.]com

The domain tespace-xmine.com was registered on October 8, 2025 through Dynadot LLC and is currently served over HTTPS using a Let’s Encrypt R12 certificate. The site presents the page title “Tspace‑Xmine – Professional Platform”, indicating an attempt to portray a legitimate professional service. HTTP responses return status code 200, confirming that the web server is actively delivering content. Infrastructure analysis shows the domain is hosted on IP address 198.23.141.202, which belongs to the HostPapa network (AS36352) located in the United States. Four name servers – ns1.pmasteck.com through ns4.pmasteck.com – resolve the domain, a configuration commonly observed in malicious hosting clusters. The IP has a Gridinsoft trust score of 0/100 and appears on a single security blocklist, PhishDestroy, confirming prior detection by anti‑phishing services. Threat intelligence records indicate the domain is listed in one AlienVault OTX pulse and has been flagged by 13 of 95 VirusTotal security vendors, reinforcing its classification as a high‑risk generic phishing site. No additional intelligence on the specific service or credential‑harvesting page has been published, leaving the exact phishing vector and targeted brands uncertain. The combination of recent registration, low trust scores, and active HTTPS delivery suggests an organized effort to lure victims. Defenders should immediately add tespace-xmine.com to URL filtering and DNS sink‑hole lists, and enforce blocklisting at email gateways to prevent malicious links from reaching users. Continuous monitoring of the associated name servers and IP address is advised, as they may be reused for future campaigns. Organizations should also review recent user activity for potential credential exposure, given the high‑risk designation and observed phishing activity.