wjbqp[.]edbqs9ccwt[.]teams-login[.]xyz

Analysis of the domain wjbqp.edbqs9ccwt.teams-login.xyz confirms its classification as an active credential phishing site targeting Microsoft Teams users. The domain, registered on November 29, 2022, through NameSilo, LLC, currently resolves to the IP address 20.58.174.214, hosted on Vultr nameservers (ns1.vultr.com, ns2.vultr.com). Google Safe Browsing has explicitly flagged this domain for social engineering, a designation consistent with phishing activity. As of August 1, 2026, the domain remains operational and is actively blocked by security platforms PhishDestroy and OpenPhish, with inclusion on two additional security blocklists.

VirusTotal analysis reports that 14 out of 91 security vendors detect this domain as malicious, providing further corroboration of its threat status. The subdomain structure ('teams-login') strongly suggests an intent to deceive users into believing the site is an official Microsoft Teams login portal, though the exact page content and phishing kit in use have not been independently verified. No SSL certificate details or HTTP response codes are provided in the available intelligence, limiting assessment of encryption or server behavior.

Defenders are advised to treat this domain as high-risk and implement immediate blocking at the DNS, proxy, and endpoint levels. Organizations should also monitor for credential reuse attempts, particularly for Microsoft 365 accounts, and consider forced password resets for any users who may have interacted with the site. Given the domain's persistence since late 2022, threat actors may continue to leverage it for credential harvesting unless disrupted through coordinated takedown efforts.