teamms-com[.]xyz

The domain teamms-com.xyz is currently flagged as a high‑risk generic phishing infrastructure and remains active as of July 12, 2026. Classification derives from multiple open‑source feeds and the presence of a page title that directly references the Unstoppable Domains brand, indicating an attempt to masquerade as a legitimate service.

Infrastructure analysis shows the domain was registered on May 14, 2026 through Unstoppable Domains, Inc. and is served by the authoritative nameservers ns1.unstoppabledomains.com and ns2.unstoppabledomains.com. DNS resolution points to the single IPv4 address 34.42.100.71, which belongs to Google Cloud (us‑central1) in the United States. The site presents a valid Let’s Encrypt certificate (YR1) and responds with an HTTP 302 redirect, a common technique used to forward victims to malicious landing pages while preserving the original URL in browser history.

Threat intelligence corroborates the phishing designation: AlienVault OTX lists the domain in one pulse, and VirusTotal reports that 2 of 95 scanned security vendors have flagged the host as malicious. The domain appears on three independent blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the consensus that it is being used for credential‑stealing or similar fraudulent activity. The limited vendor detection suggests the payload may be still evolving or that the site employs evasion techniques that reduce detection coverage.

Defenders should immediately add teamms-com.xyz to network and endpoint blocklists, enforce DNS sinkholing for the associated IP address, and monitor for any outbound connections to the Google Cloud region indicated. Continuous re‑evaluation is advised, as the specific phishing content, target audience, and any associated command‑and‑control infrastructure remain unknown pending deeper content analysis.