teams-app[.]run

On July 23, 2026 the domain teams-app.run is observed to be offline but retains a number of indicators typical of a brand-impersonation campaign targeting Microsoft Teams users. The site previously served a page titled “Download Microsoft Teams Desktop and Mobile Apps | Microsoft Teams”, directly copying official Microsoft wording, and is classified as a tech-support scam. Infrastructure analysis shows the domain is registered through Cloudflare, Inc. and resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare and is geolocated in the United States. No TLS certificate is present, meaning connections would be unencrypted. The domain is served by the Cloudflare nameservers harlee.ns.cloudflare.com and rocky.ns.cloudflare.com.

Threat intelligence sources report that 13 out of 95 security vendors on VirusTotal flag the domain as malicious, and it appears on one security blocklist. AlienVault OTX has cited the domain in 16 distinct threat pulses, and PhishDestroy has already added it to its blocked list. Reputation scoring from Gridinsoft rates the domain at 0 out of 100, indicating an extremely low trust level. The combination of a Microsoft-brand page title, the tech-support scam label, and the observed infrastructure points to a coordinated impersonation effort designed to lure victims into downloading fraudulent software or providing remote-access credentials.

Uncertainty remains regarding the current activity of the site, as the HTTP status is reported as offline and no SSL certificate is in place, suggesting the operators may have taken the site down or are rotating hosting. Defenders should continue to block the domain at perimeter firewalls and DNS filters, monitor for any future resolution to the same IP range, and incorporate the observed indicators—such as the exact page title, the Cloudflare nameserver pair, and the IP 188.114.97.3—into detection rules.