ThreatFox IOC Database

You are viewing the ThreatFox database entry for domain tlinkintegrations.eu.

Database Entry


IOC ID:1851225
IOC: tlinkintegrations.eu
IOC Type :domain
Threat Type :payload_delivery
Malware: Unknown malware
Confidence Level : Confidence level is moderate (60%)
Is compromised? : True
First seen:2026-07-15 17:22:50 UTC
Last seen:never
UUID:41568dfb-8071-11f1-97fa-42010aa4000a
Reporter DENNISAROSS
Reward 5 credits from ThreatFox
Tags:aitm kali365 m365 operator-history phishing-as-a-service reverse-proxy teams-themed

Avatar
DENNISAROSS
M365 AiTM reverse-proxy phishing domain, sibling of teamslinkintegrate.com. Full AiTM subdomain topology observed: login. / logon. (credential harvest), email. (initial contact, briefly on AWS Route 53), mp. (management panel, added 2026-03-17), success. (post-auth landing), assets. (resources), plus wildcard www. Origin IP 72.5.43.195 (AS399629 BL Networks, Bucharest RO) observed on cutover day 2025-07-10 (same day as teamslinkintegrate.com); ran through Cloudflare front (104.21.24.209 / 172.64.80.1 / 172.67.220.205) until 2026-06-10 when infrastructure was abandoned. Same origin server now hosts lite.privatetoken.app (Kali365 panel). Attribution via shared origin infrastructure.