teemspace[.]co

Analysis of the domain teemspace.co, created on June 29, 2024 and registered through Dynadot LLC, indicates active malicious activity classified as generic phishing with a high risk rating. The site returns HTTP 200 and presents the page title “Teemspace Wallet,” suggesting a crypto‑related lure. Technical fingerprinting shows a WordPress stack backed by MySQL, PHP, UIKit, LiteSpeed, jQuery, jQuery Migrate, and JivoChat, all served from Cloudflare’s network (AS13335) at IP 104.21.17.221, located in the United States. The domain uses a Let's Encrypt certificate (R12) and resolves via Cloudflare nameservers ingrid.ns.cloudflare.com and kipp.ns.cloudflare.com. It has been blocked by PhishDestroy and appears on one security blocklist; VirusTotal reports a single detection out of 95 scanned vendors. While the exact content of the landing page has not been examined, the combination of a wallet‑related title, crypto scam classification, and the presence on a blocklist supports the conclusion that the site is being used for phishing or credential harvesting targeting cryptocurrency users. Defenders should add teemspace.co to deny‑list and URL filtering rules, monitor DNS queries for the domain, and advise users to avoid any unsolicited communications referencing “Teemspace Wallet.” Continued observation is recommended to detect any changes in hosting or content that could affect threat posture.