s[.]teams-pa[.]com

This domain, s.teams-pa.com, is actively engaged in brand impersonation phishing targeting Microsoft Teams users. Analysis indicates the site is designed to mimic legitimate Microsoft collaboration portals, likely to harvest enterprise credentials or distribute malicious payloads under the guise of official communication. The domain remains operational as of this report, with no visible takedown efforts despite confirmed malicious activity. Infrastructure analysis reveals the domain was registered on February 17, 2026, through REGRU-RU, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.), a network commonly leveraged to obfuscate malicious infrastructure. The domain currently lacks an SSL certificate, increasing the likelihood of interception or tampering during transmission. Detection metrics show 12 of 95 security vendors on VirusTotal flagging the domain as malicious, while only one blocklist (PhishDestroy) has incorporated it into active filtering. The page title, 'Our website is coming soon,' suggests either a placeholder for imminent malicious deployment or an attempt to evade automated detection by presenting minimal content. The elevated risk level is justified by the combination of brand impersonation, low detection coverage, and the use of bulletproof hosting infrastructure. Organizations are advised to implement immediate network-level blocking of s.teams-pa.com and its resolving IP (188.114.97.3) at the firewall or DNS filtering layer. Security teams should monitor for internal traffic to this domain, particularly from endpoints with Microsoft 365 integrations. Given the domain's recent registration date (February 2026), it is likely part of a broader campaign; thus, retrospective log analysis for February 17 onward is recommended to identify potential prior exposure. End-user awareness training should emphasize the risks of unsolicited Teams-related communications, especially those directing users to non-Microsoft domains.