teamfast-recruits[.]org

Analysis of teamfast-recruits.org indicates that the domain was registered on July 29, 2026 through Global Domain Group LLC. The authoritative name servers are lovisa.ns.cloudflare.com and pete.ns.cloudflare.com, pointing to hosting on the Cloudflare network. DNS resolution returns the IPv4 address 104.21.65.87, which is part of Cloudflare’s edge infrastructure and does not reveal a dedicated backend server. The domain was submitted to VirusTotal and examined by 91 antivirus and URL‑reputation engines; none of the engines reported a detection at the time of the scan. The same lack of detections is recorded, but the absence of a flag does not constitute evidence of benign intent.

The domain appears on a single public blocklist and is currently listed by PhishDestroy as a blocked entry. No additional public reputation feeds, such as Google Safe Browsing or OTX, are referenced in the available intelligence. The classification provided by the source is “generic phishing,” suggesting that the site is being used to harvest credentials or personal data, although the exact content of the landing page has not been captured. Because the domain is only a few days old and is already being leveraged for malicious activity, the short operational window suggests a rapid deployment model.

Defenders should consider adding the domain to internal block lists, monitoring DNS queries for the associated IP address, and applying sink‑hole or redirect controls for traffic to the identified Cloudflare edge node. Continuous re‑scanning with VirusTotal and other multi‑engine services is advised, as detection signatures may appear after the initial analysis. Network telemetry that surfaces connections to 104.21.65.87 should be correlated with user authentication attempts to identify potential credential‑theft incidents. Until further forensic evidence is gathered, the domain remains under investigation and should be treated as hostile.