ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain teamslinkintegrate.com.

Database Entry


IOC ID:1851224
IOC: teamslinkintegrate.com
IOC Type :domain
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is elevated (65%)
Is compromised? : True
First seen:2026-07-15 17:22:51 UTC
Last seen:never
UUID:3b64ba18-8071-11f1-97fa-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:aitm kali365 m365 operator-history phishing-as-a-service teams-themed

Avatar
DENNISAROSS
M365/Teams AiTM phishing domain. Resolved to 72.5.43.195 (AS399629 BL Networks, Bucharest RO) continuously 2025-07-10 through 2026-06-02 (~11 months), on the same origin server that now hosts lite.privatetoken.app (Kali365 panel). Subdomain rs.teamslinkintegrate.com followed same pattern. Domain moved to onamae-expired.com nameservers on 2026-06-03 (expired/released) coinciding with the operator's registration of privatetoken.app on 2026-05-21. Attribution based on shared origin infrastructure. Not previously listed in ThreatFox/OTX/URLhaus.