microsoft-teams[.]run

Analysis of microsoft-teams.run shows a clear pattern of brand impersonation targeting Microsoft users. The domain was registered on August 16, 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and lacks an SSL certificate, indicating that traffic is unencrypted. The public page title reads "Join the conversation," which does not reference Microsoft but aligns with the observed tech‑support scam narrative. The site resolves to IP address 62.60.226.16, an address owned by FEMO IT SOLUTIONS LIMITED (AS214351) in Germany.

Four RegWay nameservers (dns1‑dns4.regway.com) resolve the domain, a configuration commonly used by disposable or low‑cost hosting providers. Gridinsoft assigns a trust score of 0 out of 100, and the domain is listed on a single security blocklist, confirming that at least one external repository has flagged it. VirusTotal reports that 2 of 95 scanned security vendors flag the domain, providing additional corroboration of malicious activity. PhishDestroy has actively blocked the domain, further indicating that threat‑intelligence feeds consider it abusive.

The site is currently offline, which limits immediate observation of payloads or credential‑capture mechanisms, but the combination of brand impersonation, tech‑support scam classification, low trust scores, and partial vendor detections strongly suggests a malicious intent. Defenders should continue to block the domain at network perimeter devices, monitor DNS queries for the associated IP and nameservers, and update endpoint detection rules to include the observed indicators. Because the site is offline, additional content analysis is not possible; however, any future re‑hosting of the same domain or IP range should be treated with heightened scrutiny.