teams-desk[.]live

The domain teams-desk.live is a phishing site designed to mimic Microsoft Teams. It was first detected on May 20, 2026, the same day it was created. Despite being flagged by only 2 out of 91 vendors on VirusTotal, it has already been included in 3 public blocklists, including those maintained by PhishDestroy, MetaMask, and SEAL. This suggests a rapid response to its malicious nature, even as the site has since been taken offline.

Hosted on Google Cloud's infrastructure in the US, the site used a Let's Encrypt SSL certificate, which is common among phishing sites due to its free and automated issuance process. The registrar, Unstoppable Domains Inc, is known for decentralized domain registration, which can complicate takedown efforts. The site's platform risk score of 63 out of 100 indicates a significant threat level, likely due to its impersonation tactics and potential for data theft.

The quick takedown of teams-desk.live highlights the ongoing challenge of phishing sites exploiting the brief window between domain registration and inclusion in antivirus databases. PhishDestroy's early detection capabilities play a crucial role in identifying such threats before they can cause widespread harm. While the site is no longer active, its existence underscores the importance of continuous vigilance and rapid response in the cybersecurity landscape.