s[.]teame[.]ms

This domain, s.teame.ms, is flagged as an active phishing endpoint with high-risk indicators. Registered on October 12, 2025, through Key-Systems, the domain resolves to 104.21.30.193, an address assigned to AS13335 (Cloudflare, Inc.). The infrastructure is protected by Cloudflare nameservers (fay.ns.cloudflare.com and memphis.ns.cloudflare.com) and employs HTTP/3, a protocol often used to evade traditional network-based detection. A 301 redirect is currently observed, though the destination remains undetermined due to a 403 Forbidden response on the root path, suggesting either access restrictions or a placeholder state. Analysis indicates the domain is recognized as malicious by 12 of 95 security vendors on VirusTotal, with listings on at least two security blocklists (PhishDestroy and PhishingDB). The Gridinsoft trust score of 1/100 further corroborates its classification as a confirmed phishing resource. While the exact target or phishing kit in use is not yet analyzed, the domain’s recent creation and association with Cloudflare’s network align with common tactics used to obscure malicious activity. The SSL certificate, issued by Google Trust Services (WE1), does not provide additional context regarding the intended victim or campaign. Defenders should treat this domain as hostile and implement blocking at the DNS or network layer. The 301 redirect behavior warrants monitoring for downstream domains or IPs that may be part of the same campaign. Given the 403 response, further investigation into subdomains or alternative paths (e.g., /login, /auth) is recommended to identify active phishing pages. Organizations using Cloudflare for legitimate purposes should verify that this domain is not whitelisted in security policies, as its infrastructure overlaps with benign services. No brand-specific indicators are present in the available data, limiting attribution to a generic phishing classification.