teams05live[.]us

This domain, teams05live.us, was registered on July 31, 2026, through NAMECHEAP INC and is currently resolving to the IP address 192.64.119.85. Analysis indicates it is actively serving phishing content targeting users of Microsoft Teams or related enterprise authentication workflows. The domain has been flagged by three independent security blocklists, including PhishDestroy, MetaMask, and SEAL, confirming its malicious classification. VirusTotal reports that 3 out of 91 security vendors detect this domain as malicious, though the specific payload or deception method remains unconfirmed due to limited public telemetry.

Infrastructure review shows the domain uses nameservers dns1.registrar-servers.com and dns2.registrar-servers.com, consistent with registrar-provided DNS services rather than bulletproof hosting. While the IP 192.64.119.85 has not been widely associated with known threat clusters, its use in this campaign suggests either a dedicated or compromised hosting environment. No SSL certificate details or HTTP response data were provided, so transport security and page content remain unverified. Defenders are advised to treat this domain as a high-risk phishing resource.

Network-level blocking should be implemented immediately, particularly in enterprise environments where Microsoft Teams credentials may be targeted. Monitoring for related domains using similar naming conventions (e.g., 'teams' followed by numeric or alphanumeric suffixes) is recommended, as this pattern is frequently reused in credential harvesting campaigns. Given the domain's recent registration and active status, further infrastructure expansion or domain rotation is likely. No brand-specific indicators beyond the domain name itself have been confirmed, so attribution to a specific threat actor or phishing kit remains speculative.