svc-ha-teams-office[.]com

This domain, svc-ha-teams-office.com, is under investigation for phishing activity targeting Microsoft Teams or Office 365 users. Infrastructure analysis reveals the domain was registered on March 3, 2026, through NameSilo, LLC, and is currently offline. It resolves to IP 91.208.162.2, hosted by ALEXHOST SRL (AS200019) in Moldova, a provider frequently associated with malicious infrastructure. The domain uses nameservers ns1.dnsowl.com, ns2.dnsowl.com, and ns3.dnsowl.com, a pattern observed in other phishing campaigns.

No SSL certificate is present, increasing the likelihood of interception or impersonation. The page title, svc-ha-team-office.com, closely resembles legitimate Microsoft services, suggesting an attempt to deceive users into believing the site is affiliated with Microsoft Teams or Office. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, indicating prior detection by multiple threat intelligence sources. While VirusTotal scans conducted by 93 vendors show no current detections, this absence does not confirm safety; it merely reflects a lack of recent flags.

Defenders should treat this domain as high-risk due to its hosting provider, nameserver configuration, and blocklist presence. Immediate actions include blocking the domain and IP at the network level, monitoring for related subdomains or newly registered lookalike domains, and reviewing logs for connections to 91.208.162.2. If this domain was previously active, incident response teams should investigate potential credential harvesting or malware distribution linked to this infrastructure. Further analysis of captured payloads or redirect chains is recommended to determine the exact phishing kit or campaign tactics employed.