teams-livemeet[.]com

Analysis indicates that teams-livemeet.com is an active phishing domain targeting Microsoft Teams users, registered on July 18, 2026, through Fewmoretaps OU d/b/a Trustname.com. The domain remains unresolved at the time of this report but is configured with Cloudflare nameservers (ivy.ns.cloudflare.com and patrick.ns.cloudflare.com), a common tactic to obscure hosting infrastructure. When queried, the domain resolves to IP address 188.114.97.3, which is associated with Cloudflare's network, further complicating attribution. Security vendors have begun flagging this infrastructure, with 2 of 95 engines on VirusTotal detecting malicious activity as of the report date. The domain appears on three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, confirming its classification as high-risk phishing infrastructure. No specific phishing kit or brand impersonation beyond the Microsoft Teams theme has been confirmed in available data, though the domain name suggests an intent to deceive users into believing it is an official Teams live meeting portal. Defenders should treat this domain as active and malicious, prioritizing blocking at the DNS and network layers. Given the use of Cloudflare, monitoring for changes in resolution or SSL certificate issuance may aid in tracking further abuse. Organizations using Microsoft Teams should alert users to avoid interacting with this domain and report any credential submissions or downloads initiated from it. Further analysis of the site's content, if accessed, would be required to determine the exact payload or credential harvesting mechanism in use.