teamsmeeting.site
172.67.174.185AS13335 · USpage delivers the program zecurit_agent_3.30.exe (https://teamsmeeting.site/Windows/download.php)
- Browser Analysismalicious
- Threat Intelligencemalicious
- Delivered filesuspicious
- Domain Intelligencesuspicious
- Network & Hostingclean
- Related Infrastructureclean
- TLS Fingerprintunknown
Dangerous — confirmed threat
AutomatedIts page title claims to be Microsoft, which this address is not associated with. Its web address was registered only 3 days before this scan (on 2026-10-20) — most phishing sites run on brand-new domains. It is listed on external threat-intelligence feeds. We found strong evidence that this site is malicious — for example a phishing page, a scam, or hostile code. Treat anything it asked for (passwords, card details, codes) as exposed.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
What happened
Step by step, from what the scanner recorded.Findings
Strongest firstWe analysed the file this page delivered — it is Suspicious.
Success
SHA-256 a0a6aaafa104d1a9f358453073c303dcd22a2762fee4705aa905345d1d74ab38
The page automatically triggered a file download. Normal landing pages don't do this; malware droppers do.
Analyst noteCheck the file name/type. An auto-download of an executable or archive is a strong malware-delivery tell.
The file this page handed over is the Zecurit installer itself ("zecurit_agent_3.30.exe"). Remote-management tools are legitimate software; what makes this an attack is that the visitor was given one under a different pretext, so the attacker ends up with remote control of the machine.
Analyst noteWe read this off the file the page handed over, not off the page: what the visitor was promised and what they received are different programs. ⚠️ The installer itself may well be signed and analyse Clean, because it IS the real product; the abuse is the pretext and the tenant it enrols into. Check that tenant before assuming it is not yours.
The page's download button hands the visitor Zecurit, a genuine remote-control product, while presenting itself as a document. Once run it gives an outsider live control of the machine. The installer is validly signed by its real vendor, so antivirus and file-analysis engines correctly see nothing wrong with the file — the attack is the pretext, not the payload.
Analyst noteRMM abuse: the payload is a legitimate signed Zecurit client, so file reputation will be clean by design — do not read that as a false positive. The tenant hostname and the query parameters in the target URL identify the attacker's relay and are the IOC + the abuse-report target (report to the RMM vendor, not only to the hosting provider).
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteLow/medium confidence (keyword only) — can be a news article or partner page. Corroborate before acting.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileSuspiciouszecurit_agent_3.30.exe
SHA-256a0a6aaafa104d1a9f358453073c303dcd22a2762fee4705aa905345d1d74ab38
Fromhxxps://teamsmeeting[.]site/Windows/download[.]php
Infrastructure
- IP
- 172.67.174.185CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=YE2, O=Let's Encrypt, C=US · expires Jan 18, 2027
- Redirects
- 1 hop · / → /Windows/invite.php
WHOIS
- Registrar
- NICENIC INTERNATIONAL GROUP CO., LIMITED
- Created
- Oct 20, 2026
- Expires
- Oct 20, 2027
- Nameservers
- bethany.ns.cloudflare.comhouston.ns.cloudflare.com
Hashes & fingerprints
Page capture
LiveTitle “Microsoft Teams” · brand shown: Microsoft (medium)
Engines
7 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Microsoft Teams
- Load
- 10.39 s · 6 requests