teams.de-php.info

teams.de-php.info is a subdomain of de-php.info. PhishDestroy first observed the hostname on Sep 17, 2026. Stored content metadata identifies Unknown as the apparent target. Stored page analysis classifies the content as impersonation. Current evidence score: 99/100 (critical).

Positive findings are stored from 2 sources: VirusTotal and Cloudflare Radar. VirusTotal recorded 13 detections among 89 engines: ADMINUSLabs, CyRadar, ESET, Forcepoint ThreatSeeker, Gridinsoft, Kaspersky, LevelBlue, Lionic, Seclookup, SOCRadar, Sophos, VIPRE, Webroot on Sep 19, 2026 at 10:44 UTC. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. Non-positive and contextual checks: The separate external-blocklist snapshot contained no matches on Sep 20, 2026 at 14:20 UTC. Google Safe Browsing returned no flag on Sep 19, 2026 at 10:44 UTC. URLScan completed without a malicious verdict (score 0) on Sep 18, 2026 at 03:30 UTC.

HTTP 200 was recorded on Sep 20, 2026 at 10:00 UTC. Registration records for the registrable domain de-php.info list InterNetX GmbH as the registrar. At collection time, the hostname resolved to 46.38.242.81 on AS197540 (netcup GmbH). The recorded endpoint location is Nuremberg, DE. The stored server header is nginx. DOM analysis on Sep 17, 2026 at 22:20 UTC returned 88/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan; no page title was retained, so the captures preserve the landing-page appearance. TLS metadata lists Let's Encrypt / YE2 as the certificate issuer with validity through Sep 19, 2026; checked Sep 17, 2026 at 22:02 UTC.

The content indicators and 2 positive source findings support the current Unknown-themed impersonation classification.