teams-meetings-join[.]site

The domain teams-meetings-join.site was registered on May 24, 2026 through Atak Domain Bilgi Teknolojileri A.Ş. and currently resolves to the IPv4 address 51.89.157.41, which is geolocated to the United Kingdom and associated with Limited Zelt Technologies. DNS resolution is provided by the authoritative nameservers dns24.geebyteserver.com and dns25.geebyteserver.com, and the domain hosts an MX record that points to itself. An HTTPS endpoint is present, secured by a Let’s Encrypt R12 certificate, and an HTTP request returns a 200 status code with the page title "Account Suspended". Threat intelligence indicates the domain is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that 13 of 91 security vendors have flagged the domain, and AlienVault OTX reports inclusion in four separate threat‑intel pulses. The overall risk rating is high and the campaign status is active. While the specific brand or service being impersonated has not been disclosed in the available data, the combination of recent registration, dedicated hosting, valid TLS, and multiple detections suggests a purposeful phishing operation. Defenders should add the domain and its IP address to inbound and outbound filtering rules, monitor DNS queries for the associated nameservers, and consider sharing the indicator set with upstream threat‑sharing platforms to improve collective visibility. Further investigation of the hosted content is recommended to confirm any credential‑capture mechanisms and to determine the full scope of the campaign.