teamsinvitedesktop[.]live

Analysis of teamsinvitedesktop.live indicates a confirmed phishing domain targeting Google users, operational since February 21, 2026. The domain is currently offline but was active on infrastructure hosted by Shock Hosting LLC (AS395092) in the US, resolving to IP 104.225.130.131. Nameservers point to ns3.loominost.com, ns4.loominost.com, ns7.loominost.com, and ns8.loominost.com, a pattern consistent with low-cost bulletproof hosting providers. No SSL certificate was detected, increasing the likelihood of interception or manipulation of unencrypted traffic. The page title 'Index of /' suggests either a misconfigured server exposing directory listings or an incomplete phishing kit deployment at the time of assessment.

The domain is flagged by 14 of 93 security vendors on VirusTotal and appears on three blocklists, including PhishDestroy, MetaMask, and SEAL. Registration was conducted through NameSilo, LLC, a registrar frequently used by threat actors due to its low-cost and minimal verification requirements. While the exact phishing kit or payload is not confirmed, the domain’s naming convention ('teamsinvite') implies an attempt to impersonate Google Workspace or Microsoft Teams login portals, likely aiming to harvest credentials or distribute malware under the guise of legitimate collaboration tools. Defenders should treat this domain as high-risk.

Block DNS resolution to 104.225.130.131 and monitor for any re-emergence under the same nameserver infrastructure. Given the domain’s age and detection history, it may reappear on new IPs or with updated certificates. Security teams should correlate this domain with internal logs for any prior connections from corporate networks and review email or messaging platforms for references to 'teamsinvitedesktop.live' in phishing campaigns. No evidence of active payload delivery was observed at the time of reporting, but historical exposure cannot be ruled out.