teamslives[.]us

Analysis of the domain teamslives.us indicates active brand impersonation targeting Microsoft, specifically mimicking Microsoft Teams meeting pages. The domain was registered on April 22, 2026, and currently resolves to IP address 198.54.119.191, hosted by a provider in the United States. The page title, 'Microsoft Teams meeting | Microsoft Teams,' directly replicates official Microsoft branding, suggesting an intent to deceive users into believing the site is legitimate. Technical indicators reinforce the malicious classification. The domain holds a trust score of 0 out of 100 and appears in 8 threat intelligence pulses, signaling prior detection by security sources. It is blocked by at least three security blocklists, including PhishDestroy, MetaMask, and SEAL. The site returns an HTTP 200 status, confirming active hosting, and uses a Sectigo Limited SSL certificate issued under the Sectigo Public Server Authentication CA DV R36 chain. Despite these red flags, the domain remains undetected by antivirus engines, with 0 out of 95 detections on VirusTotal as of July 12, 2026. Defenders should treat this domain as high-risk due to its confirmed impersonation of Microsoft Teams and its presence on multiple blocklists. The lack of antivirus detections does not indicate safety, as the domain’s infrastructure and behavioral indicators align with phishing campaigns. Network-level blocking is recommended for organizations, particularly those using Microsoft collaboration tools. Monitoring for similar domains registered under the same IP or certificate authority may help identify related threats. No evidence suggests the use of a known phishing kit or affiliation with broader campaign infrastructure. The domain’s creation date and hosting provider are consistent with typical phishing operations, but further forensic analysis would be required to determine the full scope of the threat. Until then, the domain remains an active risk.