miicrosofteamm.com
188.114.97.1AS13335 · USthis page sends its visitors on to https://miicrosofteamm.c…s/Windows/download.php, which handed our browser a file ("MSTeams_Setups.zip", https://miicrosofteamm.c…s/Windows/download.php) with no click
- Browser Analysismalicious
- Open Directory Scanmalicious
- Delivered fileclean
- Network & Hostingclean
- Threat Intelligenceclean
- Related Infrastructureclean
- Domain Intelligenceunknown
- TLS Fingerprintunknown
What happened
Step by step, from what the scanner recorded.Dangerous — confirmed threat
AutomatedIts page title claims to be Microsoft, which this address is not associated with. After a short wait it sends you on to another page on the same site (https://miicrosofteamm.com/teams/Windows/download.php), and that page hands a file ("MSTeams_Setups.zip") to your computer. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
Findings
Strongest firstThe page we scanned shows a wait screen and names one page on its own site as where it is about to send the visitor. We opened that page in our browser and it handed us a file — "MSTeams_Setups.zip" from https://miicrosofteamm.com/teams/Windows/download.php — without anyone clicking anything. brand impersonation (Microsoft, medium)
Analyst noteWe hold this file — it was delivered to our browser, so the file analysis on this scan is of the real payload rather than of the page. Nothing was clicked: the second page starts the download by itself. The submitted address only leads there, which is why it looks empty on its own.
The page automatically triggered a file download. Normal landing pages don't do this; malware droppers do.
Analyst noteCheck the file name/type. An auto-download of an executable or archive is a strong malware-delivery tell.
The file this page handed over is a wrapper, and the file analyser opened it and found the LogMeIn installer inside ("LogMeInResolve_Unattended.msi"). Remote-management tools are legitimate software; what makes this an attack is that the visitor was given one under a different pretext, so the attacker ends up with remote control of the machine.
Analyst noteWe read this out of the file's CONTENTS, not off the page and not off the download name — the page offered an update and the wrapper is named after it, which is why neither says anything about LogMeIn. ⚠️ The installer itself will very likely be signed and analyse Clean, because it IS the real product; the abuse is the pretext and the tenant it enrols into. Check that tenant before assuming it is not yours.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileCleanLogMeInResolve_Unattended.msi
SHA-2567e97fae503a0cdafdfaeeb218f53bbe7b7b38c6e804f3a0828368c746ef1e8f8
Fromhxxps://miicrosofteamm[.]com/teams/Windows/download[.]php
Infrastructure
- IP
- 188.114.97.1CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=WE1, O=Google Trust Services, C=US · expires Oct 26, 2026
- Redirects
- 2 hops · /teams/Windows/ → /teams/Windows/invite.php
WHOIS
- Registrar
- NameSilo, LLC
- Created
- Jul 28, 2026
- Expires
- Jul 28, 2027
- Nameservers
- desi.ns.cloudflare.comtim.ns.cloudflare.com
Hashes & fingerprints
Page capture
LiveTitle “Microsoft Teams” · brand shown: Microsoft (medium)
Engines
8 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Microsoft Teams
- Load
- 9.49 s · 4 requests