s[.]team-zt[.]com

Analysis of s.team-zt.com indicates a high‑risk generic phishing operation. The domain was registered on May 08, 2025 through Web Commerce Communications Limited and is currently taken offline, suggesting that the malicious infrastructure has been disrupted or abandoned. DNS resolution points to the IPv4 address 194.87.216.152, which is hosted in the Netherlands under autonomous system AS215540 (Global Connectivity Solutions LLP). Both authoritative nameservers are Cloudflare‑managed (KANYE.NS.CLOUDFLARE.COM and MELANY.NS.CLOUDFLARE.COM), a common choice for threat actors seeking rapid DNS changes and DDoS protection.

The site employed a Let’s Encrypt E7 certificate, providing valid TLS encryption but offering no indication of legitimacy. Reputation signals are strongly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. Google Safe Browsing flags the site for social engineering, and PhishDestroy has also blocked it. VirusTotal analysis shows that 16 of 93 scanned security vendors flagged the domain, confirming the presence of malicious indicators.

The combination of a low trust score, blocklist presence, multiple vendor detections, and a recent creation date aligns with typical phishing infrastructure. Uncertainty remains around the exact payload or credential‑harvesting mechanisms because no page‑title or content details have been disclosed. Defensive actions should include adding the domain to local blocklists, monitoring DNS queries for the associated IP and Cloudflare nameservers, and ensuring that any inbound traffic to the IP is denied. Organizations should also update web‑filtering solutions to reflect the Google Safe Browsing classification and consider sharing the indicators with threat‑intelligence sharing platforms to aid broader community mitigation.