s[.]teams-ln[.]com

PhishDestroy identifies s.teams-ln.com as an active fake Microsoft Teams login phishing domain designed to steal user credentials and cryptocurrency. This domain is currently live and operational, posing an immediate threat to unsuspecting users who may inadvertently enter sensitive information. The threat actor employs a deceptive domain structure mimicking official Microsoft services to facilitate credential harvesting and potential financial theft. This domain was flagged by 10 of 95 VirusTotal security vendors, indicating a high likelihood of malicious activity. Registered through Registrar of Domain Names REG.RU LLC, s.teams-ln.com resolves to IP address 104.21.29.169 and was created on March 29, 2026. The domain has been listed on 2 security blocklists and operates with a valid Let's Encrypt SSL certificate to enhance its appearance of legitimacy. Notable security platforms including OpenPhish and PhishingArmy have already blocked access to this domain. Security researchers and users are strongly advised to avoid interacting with s.teams-ln.com due to confirmed malicious intent. PhishDestroy recommends verifying domain safety through its threat intelligence database before accessing any suspicious links. Users who may have already entered credentials on this domain should immediately change passwords and enable two-factor authentication on all associated accounts. Additionally, monitoring financial transactions for unauthorized activity is highly recommended to mitigate potential cryptocurrency losses.