web-teams[.]live

This domain, web-teams.live, is designed to mimic legitimate Microsoft Teams login pages with the intent to harvest user credentials. Analysis indicates the site presents a fraudulent authentication interface that closely resembles the official Microsoft Teams portal, tricking users into entering their corporate or personal login details. The stolen credentials are likely used for unauthorized access to sensitive accounts, corporate networks, or further phishing campaigns targeting colleagues or contacts. Infrastructure analysis reveals multiple red flags confirming its malicious nature. The domain was registered on April 08, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Security vendors have flagged it in 4 out of 95 detection engines, and it appears on three independent security blocklists. The domain resolves to the IP address 104.21.31.211, which has been linked to other phishing infrastructure in recent threat intelligence reports. If you or someone in your organization visited web-teams.live, immediate action is required. First, reset any credentials entered on the site, especially those used for corporate accounts or email services. Enable multi-factor authentication on all critical accounts to prevent unauthorized access. Report the incident to your organization’s security team or IT administrator for further investigation. Monitor accounts for unusual activity, such as unauthorized logins or unexpected password reset emails, and consider scanning devices for malware if any files were downloaded from the site.