my-team[.]homes

This domain, my-team.homes, is flagged as an active brand impersonation phishing site, presenting an elevated risk to users. Analysis indicates the threat is designed to mimic legitimate corporate or team-based login portals, likely aiming to harvest credentials or deploy malicious payloads under the guise of trusted communication. The domain’s infrastructure and rapid deployment suggest a targeted campaign rather than opportunistic phishing, increasing the potential for successful compromise of sensitive accounts. Infrastructure analysis reveals the domain was registered on June 12, 2024, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which is part of a network known for hosting phishing and malicious content. The domain appears on two security blocklists, including PhishDestroy and ScamSniffer, and is flagged by 1 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while employing Cloudflare and HTTP/3 to obfuscate detection and analysis. The use of Cloudflare Browser Insights further suggests an attempt to monitor victim interactions in real time. Mitigation against this brand impersonation threat requires a multi-layered approach. Organizations should implement strict email and web filtering to block access to the domain and its associated IP. Users should be trained to verify the authenticity of login portals by checking domain names, SSL certificates, and URLs before entering credentials. Network-level monitoring for connections to 188.114.97.3 or domains registered via Gname.com can help detect compromised endpoints. Additionally, enabling multi-factor authentication (MFA) on all accounts can mitigate the impact of credential theft, even if phishing attempts succeed. Immediate reporting of suspicious login attempts to security teams is critical to limiting exposure.