s[.]teams[.]ht

The domain s.teams.ht was observed hosting a credential-collection page titled “Sign In”. The page title suggests an attempt to lure users of the Counter-Strike franchise, and the intelligence explicitly labels the campaign as a Counter-Strike impersonation. Infrastructure analysis shows the hostname resolves to 188.114.97.3, an address owned by Cloudflare, Inc. (ASN 13335) and geolocated to the United States. No TLS certificate is presented, indicating the site was served over plain HTTP at the time of capture.

VirusTotal reports indicate that ten of ninety-five scanning engines flagged the domain as malicious, providing independent confirmation of its abusive nature. The domain is listed on a single external blocklist and has been actively blocked by the PhishDestroy service, further corroborating its reputation as a threat vector. Current monitoring indicates the site has been taken offline, but the underlying infrastructure remains under the control of the same hosting provider, allowing rapid re-deployment. Defenders should continue to block the IP address 188.114.97.3 at network perimeters and ensure that any outbound connections to this host are denied.

Email and web gateway filters should be updated to flag URLs containing the “s.teams.ht” suffix, especially when paired with login-related keywords. Because the domain lacks SSL, any attempt to establish a secure channel will fail, providing an additional indicator for automated detection. Analysts should monitor Cloudflare-hosted IP ranges for similar short-lived impersonation domains and consider sharing indicators of compromise with threat-intelligence communities. Until the domain reappears, the elevated risk rating remains justified, and continued vigilance is advised.