s[.]teampp[.]cfd

s.teampp.cfd is a subdomain of teampp.cfd. PhishDestroy first recorded this hostname on Oct 22, 2025. The assembled evidence scores 94/100 (critical).

One independent source is positive: VirusTotal. VirusTotal recorded 13 detections among 95 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Lionic, SOCRadar, Sophos, VIPRE, Webroot on May 19, 2026 at 06:16 UTC. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. URLQuery recorded no positive detection. Google Safe Browsing returned no flag on Mar 3, 2026 at 04:14 UTC. URLScan completed without a malicious verdict on Mar 4, 2026 at 01:13 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:23 UTC; content was unavailable. Registration records for the registrable domain teampp.cfd list Web Commerce Communications Limited as the registrar and Aug 6, 2025 as the creation date. At collection time, the hostname resolved to 172.67.204.116 on AS13335 (CLOUDFLARENET, US). The associated network metadata labels the endpoint as AS13335 Cloudflare, Inc. in San Francisco, US. The stored server header is cloudflare. DOM analysis completed on Apr 24, 2026 at 15:20 UTC; stored DOM score 0/100. The evidence archive retains 2 visual captures from PhishDestroy and URLScan. IoC extraction completed on Aug 2, 2026 at 04:32 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators.

No page title was retained; the visual captures, not a title string, preserve the landing-page appearance. No target brand has been confirmed from stored page content; hostname wording alone is not treated as brand evidence. The 0/100 DOM score means that the DOM pass stored no scored indicators; it does not negate the independent source findings. The stored record does not establish the post-click interaction, and it does not claim a confirmed wallet-draining transaction or credential submission.