s[.]team-lz[.]world

Analysis of the domain s.team-lz.world indicates it was actively impersonating the Base brand as part of a brand impersonation scam. The domain was registered on February 21, 2026, and resolved to the IP address 172.67.173.145, hosted on Cloudflare's infrastructure (AS13335) in the United States. At the time of assessment, the domain was offline, though it previously displayed the page title 'Faceit Universe,' which does not align with the targeted brand. No SSL certificate was detected for this domain.

Eleven of 93 security vendors on VirusTotal flagged s.team-lz.world as malicious, and it appears on at least one security blocklist (PhishDestroy). The Gridinsoft trust score for this domain is 0/100, further supporting its classification as high-risk. While the exact content of the site remains unanalyzed, the available indicators—including the domain registration date, hosting provider, and detection by multiple security vendors—suggest it was designed to deceive users by mimicking Base.

Defenders should treat this domain as compromised and ensure it is blocked at the network and endpoint levels. Monitoring for similar domains using the same infrastructure (e.g., Cloudflare IPs or newly registered domains with 'team' or 'lz' patterns) may help identify related threats. Given its current offline status, further forensic analysis of the domain's historical content is not possible, but the existing indicators justify its classification as a confirmed brand impersonation threat.