Hexa Tiger 
Scale My Publication 
SEO for Public Figures 
A fake Microsoft Teams login at teams-cloud.live has prompted cybersecurity researcher Steven Lim to urge companies to block the domain. Lim flagged the five-day-old site on October 18, 2026, after finding that it copied the Teams sign-in page and interface. His warning about the fake Teams login urges companies to block it.
The warning does not establish that anyone entered credentials. A Teams update option downloaded a text file, but its contents and behavior have not been published.
What the Fake Microsoft Teams Page Shows
Lim said the domain was about five days old when he found it, putting registration around October 13. The copied interface resembles a work sign-in screen, but the address belongs to a third party.
A pinned comment cited amgen.teams-cloud.live as a subdomain carrying a healthcare company’s name. It does not show that Amgen was targeted successfully or suffered a breach. The domain operator remains unknown.
The update option downloads a TXT file, but the report provides no contents, digital fingerprint or evidence that it executes. The account does not establish that the download is malware.
Why the Fake Microsoft Teams Domain Stands Out
The address is the clearest visible distinction: teams-cloud.live is not a Microsoft sign-in domain. The source says that Microsoft sign-in pages use Microsoft domains such as microsoft.com or microsoftonline.com. A familiar logo and colors cannot make a different address an official service.
That mismatch links to previous coverage of lookalike domain names, which describes similar-looking characters in deceptive addresses. Another report on Cloudflare Pages scam sites covers a separate campaign, with no established connection to teams-cloud.live.
Lim had also flagged teams-online.com on October 8, reporting zero detections from Microsoft Defender. He did not specify the Defender product or settings, so the figure is a snapshot. Similarity does not prove a shared operator.
Blocking and Reviewing Activity
Lim recommends that companies block teams-cloud.live and inspect web access logs for visits. His report says Microsoft 365 tenant administrators can add the domain to the Tenant Allow/Block List. To include subdomains, the entry uses a leading tilde: ~teams-cloud.live.
According to the cited Microsoft guidance, matching messages are treated as high-confidence phishing and quarantined. The entry takes effect within 5 minutes and expires after 30 days by default, with options to extend it to 90 days or set it to never expire. The list has 500 block entries without Defender for Office 365, 1,000 with plan 1 and 10,000 with plan 2.
Email blocking does not itself prevent a browser from opening a site. The source says Defender for Endpoint network protection can block a domain through custom indicators, with conditions for browsers other than Edge and a delay of up to two hours. Organizations using other tools can use DNS filtering or a corporate proxy, the report says.
Administrators can review access logs for both domains. A visit alone does not prove stolen credentials; the source recommends checking sign-in logs.
What to Do After a Sign-In
Opening the page without entering information does not create a concrete account risk, according to the report. If someone submitted a work email and password, the source advises resetting the password, closing active sessions, and checking for new sign-in methods or mailbox forwarding rules.
The report identifies FIDO2 passkeys as a defense because they are tied to the site where they were created. Microsoft describes an organizational rollout path, though distributing keys and recovering lost accounts require effort. This fake Microsoft Teams page cannot use a passkey tied to Microsoft’s real domain, according to the report.
Lim’s warning leaves key facts unresolved: how many people visited, whether any passwords were captured, what the TXT file contains and who operates the domain. Blocking the address and reviewing relevant logs are the immediate steps described while those details remain unknown.
Related reporting has examined Cloudflare’s app deployment tools; that coverage is separate from this domain warning and adds no evidence about its operator.
