teamsdownload[.]info

This domain, teamsdownload.info, is actively engaged in generic_phishing operations impersonating Microsoft Teams infrastructure. The threat is designed to deceive users into entering credentials or downloading malicious payloads under the guise of legitimate Teams updates or login portals. Analysis indicates the domain mimics corporate communication tools, exploiting trust in widely used collaboration platforms to facilitate unauthorized access or malware distribution. Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on March 12, 2026, through Name.com, Inc., and resolves to IP address 169.63.242.100, hosted on AS36351 within a known cloud provider network. It appears on two independent security blocklists and is flagged by 9 out of 95 security vendors on VirusTotal, including detection labels for credential harvesting and phishing. The SSL certificate, issued by Sectigo Limited under the Sectigo Public Server Authentication CA DV R3, provides minimal assurance, as it lacks extended validation and is commonly abused in phishing campaigns. Users who have visited teamsdownload.info should immediately revoke any entered credentials, particularly those associated with Microsoft 365 or corporate accounts. Network administrators are advised to block the domain and its resolving IP at perimeter defenses. Endpoints should be scanned for unauthorized software or anomalous processes, as the domain may have delivered secondary payloads. If authentication occurred, enable multi-factor authentication and monitor for unauthorized access attempts. The domain remains active as of this report, necessitating continued vigilance.