teams-sn[.]cfd

This domain, teams-sn.cfd, is flagged for generic phishing activity impersonating Microsoft Teams login portals. Analysis indicates the site likely functions as a credential harvester, capturing user authentication details submitted through fraudulent login forms. No direct association with known crypto drainer kits has been established, but the domain follows patterns consistent with large-scale phishing campaigns targeting enterprise communication platforms. Technical indicators reveal the domain was registered on June 20, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. It currently resolves to IP address 172.67.162.195, a Cloudflare proxy endpoint. VirusTotal reports 0/95 detections, suggesting the domain remains undetected by major security vendors at the time of analysis. AlienVault OTX lists the domain in one threat intelligence pulse, though no additional context is provided. Google Safe Browsing status is not explicitly cited, and no blocklist entries beyond the single OTX pulse are confirmed. The domain remains active, with no takedown or sinkholing actions observed. Response recommendations include immediate blocking of the domain and IP at perimeter security controls, along with monitoring for internal network connections to 172.67.162.195. Organizations should review authentication logs for signs of credential compromise, particularly for users who may have interacted with Microsoft Teams-related links in the past 48 hours. Given the zero-detection status on VirusTotal, manual inspection of web traffic and endpoint logs is advised to identify potential infections or data exfiltration attempts.