team-authenticaton[.]pro

PhishDestroy identifies active credential-harvesting infrastructure hosted at team-authenticaton.pro, a recently registered domain designed to mimic creative studio content while surreptitiously collecting user credentials. This domain employs a generic phishing kit and does not currently impersonate a specific brand, instead relying on a false identity as 'Marginalia / Series G — Notes from the Studio'. The campaign’s shallow mimicry and lack of branding sophistication suggest an opportunistic, low-cost operation aimed at harvesting login credentials from unsuspecting visitors.

This domain was flagged during routine surveillance with the following technical indicators: VirusTotal detection score of 1/95, registered through Global Domain Group LLC on May 04, 2026, resolving to IP address 172.67.190.30 using a Let's Encrypt SSL certificate. As of the latest scan, the domain remains unlisted on Google Safe Browsing and has not been added to any public blocklists. The domain is newly created with no historical reputation data, increasing the risk of successful exploitation by threat actors.

The campaign is currently active, with threat actors likely using email spam or social media links to direct victims to the fraudulent 'Notes from the Studio' page. Immediate action is recommended: block access to team-authenticaton.pro at the network and endpoint levels, flag for employee/user awareness training, and monitor for associated malicious infrastructure. Remaining risk is assessed as high due to the domain’s recent registration, lack of detection, and active hosting of a credential-harvesting page. Continuous monitoring and proactive blocking are essential to prevent credential theft and potential downstream account compromise.