teams-workplace[.]live

PhishDestroy identifies teams-workplace.live as an active phishing domain impersonating Microsoft Teams, currently under investigation by the SOC team. This domain represents a generic phishing threat that could lead to credential harvesting and account takeover if accessed by employees or customers.

This domain was flagged by 1 of 95 VirusTotal vendors, registered via Unstoppable Domains Inc on May 15, 2026, and resolves to IP 34.42.100.71 using a Let’s Encrypt SSL certificate, indicating a low but credible threat level at this stage. No blocklist hits were recorded as of the latest scan, underscoring the need for immediate proactive defense.

Teams-workplace.live remains active and must be blocked at the firewall and DNS level to prevent access. We recommend updating blocklists, disabling access via proxy rules, and conducting user awareness training focusing on recognizing Teams impersonation lures. Monitor logs for connections to 34.42.100.71 and inspect outbound SSL traffic to detect potential exfiltration or post-compromise callbacks.