teams-invite[.]io

On 19 July 2026 analysts assigned seed 48cabe flagged the domain teams-invite.io as a high-risk brand-impersonation campaign targeting Microsoft users. The site presents the page title “Microsoft Outlook – Meeting Invitation” and serves over HTTPS using a Let’s Encrypt (YR1) certificate, suggesting a short-lived or newly issued certificate. DNS resolution points to IP 187.77.96.172, an address hosted in the United Kingdom by Hostinger GB. The HTTP response returns status 200, indicating the landing page is reachable. The domain is listed on three public blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows six of ninety-one scanners flag the domain as malicious, and AlienVault OTX includes it in two separate threat pulses, reinforcing its malicious reputation. Infrastructure details beyond the hosting IP are not publicly disclosed; the page content has not been captured, so the specific credential-harvesting technique remains unknown. Defenders should add teams-invite.io and the associated IP to outbound and inbound block rules, monitor DNS queries for the domain, and apply URL filtering based on the observed blocklist entries. User education should emphasize scrutiny of unsolicited Outlook meeting invitations, particularly those requesting credentials or redirecting to external sites. Continuous feed updates are recommended to capture any future changes in hosting or certificate attributes.