teams-live[.]com[.]cn

This domain, teams-live.com.cn, is flagged as a high-risk brand impersonation threat targeting Microsoft. Analysis indicates the site mimics Microsoft Teams, presenting itself as a Chinese remote collaboration solution with payment processing capabilities. The page title, "Microsoft Teams 远程协作解决方案 - 中国企业远程团队项目交付首选工具," directly misrepresents official Microsoft branding to deceive enterprise users into submitting sensitive information or financial transactions. Infrastructure analysis reveals concrete technical indicators of compromise. The domain was registered on May 17, 2026, through Web Commerce Communications Limited, resolving to IP address 103.101.191.15. It appears on three security blocklists, including MetaMask and PhishDestroy, and holds a VirusTotal detection score of 14/95 from security vendors. The site employs Let’s Encrypt SSL certificates and utilizes technologies such as Nginx, Cloudflare, and Google Analytics, which are commonly observed in both legitimate and malicious infrastructures. The Gridinsoft trust score of 0/100 further corroborates its fraudulent nature. Currently, teams-live.com.cn is offline, reducing immediate exposure risk. However, historical DNS records and residual threat indicators remain a concern. Organizations should monitor for reemergence under similar domains or IP ranges, particularly those leveraging Cloudflare or Let’s Encrypt certificates. Security teams are advised to block the domain, IP, and associated SSL fingerprints in perimeter defenses, while end-users should be educated on recognizing brand impersonation tactics in remote collaboration tool phishing schemes.