# PhishDestroy threat dossier — teamsliue.us ================================================================ Fetched: 2026-07-21 23:06:05 UTC Canonical: https://phishdestroy.io/domain/teamsliue.us/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 60/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 0/94 security vendors flagged this domain URLQuery: -1 detections Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 66.29.141.235 (US, Los Angeles) ASN: AS22612 Namecheap, Inc. Hosting org: Namecheap, Inc. Registered: 2026-04-20 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Sectigo Limited / Sectigo Public Server Authentication CA DV R36 Expires: 2026-11-04 Status: INVALID chain Fingerprint: a803a731474238edf39d379cd17c3aa81108602b2aab88ebd3366a7677ba3cd4 Subject Alternative Names (related infrastructure — often same operator): - www.teamsliue.us ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-20 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-20 19:30:08 UTC (by PhishDestroy tracker) First reported: 2026-06-15 00:27:29 UTC (abuse notice filed) Last verified: 2026-07-22 00:20:53 UTC Neutralised: 2026-04-20 22:37:05 UTC Current status: taken down (registrar suspended or DNS dead) ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-18 17:22:31 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] teamsliue.us Fake Microsoft Teams Credential Theft Alert The domain teamsliue.us has been identified as a credential theft phishing site specifically designed to impersonate Microsoft Teams, a widely used collaboration platform. This domain is currently offline, but its recent activity poses a significant risk to users who may have encountered it while it was active. The threat type is classified as generic phishing with a focus on stealing login credentials, making it a serious concern for organizational security. Technical analysis reveals that teamsliue.us was created on April 20, 2026, and its SSL certificate was issued by Sectigo Limited through their Sectigo Public Server Authentication CA DV R36. The domain resolves to the IP address 66.29.141.235 and is listed on three security blocklists, indicating that it has been flagged by some threat intelligence sources. Despite this, VirusTotal shows zero detections out of 95 vendors, meaning the domain has not yet been widely recognized as malicious by antivirus engines. This low detection rate underscores the importance of proactive monitoring and user awareness. Given that the domain is now offline, the immediate risk of further credential theft is mitigated, but any users who may have visited the site or entered credentials should change their passwords immediately and enable multi-factor authentication. Organizations should review logs for any connections to the IP 66.29.141.235 and educate employees about phishing attempts impersonating Microsoft Teams. Continuous monitoring for similar domains and blocking the identified indicators is recommended to prevent future incidents. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: a803a731474238edf39d379cd17c3aa81108602b2aab88ebd3366a7677ba3cd4 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/teamsliue.us/ JSON API: https://api.destroy.tools/v1/check?domain=teamsliue.us Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 187,720 domains (57,297 alive under monitoring, 128,779 confirmed takedowns/dead). Site: https://phishdestroy.io