s[.]teams-pl[.]com

This domain, s.teams-pl.com, was registered on 29 October 2025 through Name SRS AB and is hosted on Cloudflare infrastructure (ASN 13335) with the IP address 172.67.188.61 located in the United States. The authoritative nameservers are joaquin.ns.cloudflare.com and sofia.ns.cloudflare.com. No TLS certificate is presented, and HTTP requests return a 403 Forbidden status, indicating that the site is currently inaccessible. The domain is listed as offline in the latest intelligence and has been taken down by the phishing mitigation service PhishDestroy.

Reputation services show a uniformly negative assessment: Gridinsoft assigns a trust score of 0 / 100, the domain appears on one security blocklist, and 13 of 95 VirusTotal vendors flag it as malicious. The absence of a valid certificate combined with the 403 response suggests that the phishing payload, if any, is no longer being served. However, the recent creation date, the use of Cloudflare’s CDN, and the detection history indicate that the domain was employed in a generic phishing campaign, likely to lure victims to a counterfeit login portal. Defenders should continue to block the domain and its resolving IP address at perimeter firewalls and DNS filtering solutions.

Because the domain resolves through Cloudflare, future adversary‑controlled sub‑domains could reuse the same IP range, so a broader Cloudflare‑IP blocklist may be warranted. Continuous monitoring of passive DNS and reputation feeds is recommended to detect any re‑registration or reuse of the domain by threat actors. Organizations that have previously observed phishing attempts targeting similar naming patterns should update their email security policies to flag messages containing the “teams‑pl” string. Until the domain is definitively retired, maintaining the block in security controls reduces the risk of accidental exposure.