teoma[.]miocrosoft[.]top

Analysis indicates that the domain teoma.miocrosoft.top was registered through Gname.com Pte. Ltd. on 24 September 2025. The domain resolves to the IPv4 address 172.245.67.31, which belongs to AS36352 operated by HostPapa in the United States. The authoritative nameservers are a6.share-dns.com and b6.share-dns.net. An SSL certificate is present and resolves to 172.245.67.50, confirming that TLS is being offered for the site. The page title observed during a brief crawl reads "Teams官网 - Teams中文版", suggesting an attempt to mimic Microsoft Teams in Chinese.

The threat classification is recorded as a tech‑support scam that impersonates Microsoft. VirusTotal scans show nine out of ninety‑five AV engines flagging the domain as malicious, and it is listed on one external blocklist. The domain has been taken offline and is currently blocked by the PhishDestroy sinkhole. Gridinsoft assigns a trust score of 0 out of 100, indicating a lack of credibility. The combined indicators—recent registration, hosting on a shared DNS service, low trust score, malicious detections, and brand‑targeted page title—support the elevated risk rating.

Uncertainty remains around the exact content served before takedown, as no visual or form analysis is available. It is also unclear whether additional infrastructure such as command‑and‑control servers or credential‑harvesting pages is associated with the same IP range. Defenders should add teoma.miocrosoft.top to URL filtering lists, block the resolved IPs 172.245.67.31 and 172.245.67.50 at the network perimeter, and monitor for any outbound connections to the HostPapa AS36352 network. Email security gateways should enforce strict domain‑based authentication for any messages claiming to originate from Microsoft, and SOC analysts should flag any alerts referencing the observed page title or the impersonated brand. Continuous re‑scanning of the domain, even after takedown, is advised to capture any re‑registration attempts.