Is s.team-lw.com safe?
http://s.team-lw.com/
Checked on
How we checked
Coverage: partial · 5 of 6 applicable core capabilities
- Antivirus (66 of 97 engines answered) · saved result: did not fully complete
- Google Safe Browsing: completed
- page reading: completed
- page capture: completed
- domain records: completed
- web research: completed
A one-day-old domain that bounces visitors to a Russian-language admin panel for generating short-lived, template-based login links
s.team-lw.com hosts nothing of its own: it redirects the browser to https://domain.tbegod.com/panel, which shows a 'TBELINK' / 'TBE panel v2' login screen for an 'invite system' control panel. That panel's own menu offers link generation, domain management, 'Логинки (Шаблоны)' login-page templates, iframe and base-path settings, a ban checker and a domain-purchase item, with generated links lasting 1 to 168 hours in five languages. The parent domain was registered one day before the scan, and independent checks describe the domain as malicious and reported for phishing. Nothing here is a consumer product, so the score reflects the operator and infrastructure risk rather than a shop or payment flow.
Where this site sits
- Dangerous1–20
- High Risk21–44
- Moderate Risk45–69
- Low Risk70–84
- Safe85–100
The score combines saved evidence strength and analysis quality. Coverage is reported separately.
Why 22/100
High Risk covers scores 21–44. 6 findings pulled the score down; 1 pushed it up.
What pulled the score down
- ModerateThe panel generates links from selectable login-page templates in five languages with lifetimes of 1 to 168 hours, alongside iframe, base-path and ban-checker controls.
- ModerateOne public warning in public web research: "This website has been classified as malicious by IPQS"
- ModerateThe destination presents an admin login and password form that collects credentials for an undisclosed operator.
- MinorThe page redirected the browser to an unrelated external domain.
- MinorThe parent domain was registered one day before the scan.
- MinorNo company, address, phone or policy page is shown; the only community contact is a Discord invite.
What pushed the score up
- SupportsSafe Browsing returned no warning, TLS was valid and the hosting IP has no abuse reports.
No points per finding are stored for this report: our analysis weighed all findings together to set the score. Each finding shows its saved severity instead (Decisive, Strong, Moderate or Minor).
Lost money or shared details on s.team-lw.com? Do this now
Act quickly: the first hours matter most for a chargeback.
- Call your bank or card issuer now
Ask them to dispute the charge or open a chargeback; the sooner you act, the better your odds. Card payments can often be reversed. Bank transfers and gift cards are harder, but report them to your bank too. Crypto payments usually cannot be reversed: report the wallet address and transaction ID to the exchange you sent from.
- Change any password you entered
If you entered a password on s.team-lw.com, change it there and anywhere you reused it, and turn on two-factor authentication. Keep screenshots, order confirmations and messages as evidence.
- Report the site
Reports help get scam sites taken down faster and warn other people.
- Report the domain to its registrar
Dominet (HK) Limited takes abuse reports at domainabuse@service.aliyun.com (+86.95187). Include the address and what happened.
- Ignore anyone offering to recover your money
"Recovery" services or agents who contact you, or ask for a fee up front, are almost always a second scam aimed at victims. Your bank's dispute process and the official reporting services never charge a fee in advance.
Full answers about refunds and reporting are in the Safety FAQ below.
01 · Investigation Brief
Investigation Brief
s.team-lw.com hosts nothing of its own: it redirects the browser to https://domain.tbegod.com/panel, which shows a 'TBELINK' / 'TBE panel v2' login screen for an 'invite system' control panel. That panel's own menu offers link generation, domain management, 'Логинки (Шаблоны)' login-page templates, iframe and base-path settings, a ban checker and a domain-purchase item, with generated links lasting 1 to 168 hours in five languages. The parent domain was registered one day before the scan, and independent checks describe the domain as malicious and reported for phishing. Nothing here is a consumer product, so the score reflects the operator and infrastructure risk rather than a shop or payment flow.
A redirector in front of an invite-link panel
The scanned address does not serve content. It sends the browser to an unrelated external domain, https://domain.tbegod.com/panel, so whatever the visitor sees belongs to that destination rather than to s.team-lw.com.
The destination is a login screen branded 'TBELINK' with the Russian subtitle 'Панель управления инвайт-системой' (invite-system control panel) and the version label 'TBE panel v2'. It asks for an admin login and password before anything else is shown.
Behind that login sits a toolset for producing links: 'Создать ссылку' (create link), active links, domains, 'Логинки (Шаблоны)' login-page templates, roles, iframe, base path, a ban checker, a password section, a 'Купить домен' (buy domain) item and a builder. The generator lets the operator pick a domain, a template, a page language (RU, EN, DE, PL, TR), a worker label and a lifetime from 1 to 168 hours, and it advertises unlimited link generation from the panel.
The only community contact shown is a Discord invite (discord.gg/tbeteam), plus a link to a second 'LoshkaLink' panel. No company, address, phone or policy page appears on the rendered page, and because the address redirects elsewhere, the destination's contact details were not attributed to the scanned host.
Fresh domain, phishing reports and no disclosed owner
The parent domain team-lw.com was registered one day before the scan, which fits a redirector stood up specifically to point at the panel rather than an established service.
Independent checks classify the domain as malicious and report it for phishing, and note that its registrar is popular among scammers. A separate low-trust assessment of the related 'tbeelink' name reaches the same conclusion.
The panel's feature set — swappable login-page templates, iframe embedding, base-path control, a ban checker and links that expire within hours — is the toolkit used to rotate disposable landing and sign-in pages quickly. That is infrastructure description, not a detection, but combined with the phishing reports and the one-day-old domain it points to a credential-collection operation rather than a legitimate service.
Clean technical checks do not clear the operator
The browser threat feed returned no threat warning, the saved TLS check found a valid encrypted connection, and the hosting IP carries an abuse confidence score of 0 across no saved reports. These mean no detection was recorded at scan time, not that the site is trustworthy.
The saved antivirus analysis is from August 2025, before the domain's current registration in November 2026, so it describes an earlier owner's site and counts neither for nor against this one.
Why the score is 22
The panel generates links from selectable login-page templates in five languages with lifetimes of 1 to 168 hours, alongside iframe, base-path and ban-checker controls.
02 · Security Evidence
Security evidence
Antivirus Engines
0/ 97
No resultsSaved analysis from August 3, 2025 - stale
Analysis predates the current registration
The saved antivirus analysis is from August 3, 2025, which is before this domain's current registration, so it may describe an earlier owner. It is not counted as a clean result.
- Malicious
- 0
- Suspicious
- 0
- Total
- 97
All 97 engine results
- 0xSI_f33d - Unrated
- Abusix - Clean
- Acronis - Clean
- ADMINUSLabs - Clean
- AILabs (MONITORAPP) - Clean
- AlienVault - Clean
- alphaMountain.ai - Unrated
- AlphaSOC - Unrated
- Antiy-AVL - Clean
- ArcSight Threat Intelligence - Unrated
- Artists Against 419 - Clean
- AutoShun - Unrated
- Axur - Unrated
- benkow.cc - Clean
- Bfore.Ai PreCrime - Unrated
- BitDefender - Clean
- Bkav - Unrated
- BlockList - Clean
- Blueliv - Clean
- Certego - Clean
- Chong Lua Dao - Clean
- CINS Army - Clean
- Cluster25 - Unrated
- CMC Threat Intelligence - Clean
- CRDF - Clean
- Criminal IP - Clean
- CSIS Security Group - Unrated
- Cyan - Unrated
- Cyble - Clean
- CyRadar - Clean
- desenmascara.me - Clean
- DNS8 - Clean
- Dr.Web - Clean
- EmergingThreats - Clean
- Emsisoft - Clean
- Ermes - Unrated
- ESET - Clean
- ESTsecurity - Clean
- Feodo Tracker - Clean
- Forcepoint ThreatSeeker - Unrated
- Fortinet - Clean
- Fortra - Unrated
- G-Data - Clean
- GCP Abuse Intelligence - Unrated
- Google Safe Browsing - Clean
- GreenSnow - Clean
- Gridinsoft - Unrated
- Heimdal Security - Clean
- Hunt.io Intelligence - Unrated
- IPsum - Clean
- Juniper Networks - Clean
- Kaspersky - Unrated
- Lionic - Clean
- Lumu - Unrated
- Malwared - Clean
- MalwarePatrol - Clean
- malwares.com URL checker - Clean
- MalwareURL - Unrated
- Mimecast - Unrated
- Netcraft - Unrated
- OpenPhish - Clean
- PhishFort - Unrated
- Phishing Database - Clean
- Phishtank - Clean
- PREBYTES - Clean
- PrecisionSec - Unrated
- Quick Heal - Clean
- Quttera - Clean
- Rising - Clean
- SafeToOpen - Unrated
- Sangfor - Clean
- Sansec eComscan - Unrated
- Scantitan - Clean
- SCUMWARE.org - Clean
- Seclookup - Clean
- securolytics - Clean
- Snort IP sample list - Clean
- SOCRadar - Unrated
- Sophos - Clean
- Spam404 - Clean
- StopForumSpam - Clean
- Sucuri SiteCheck - Clean
- ThreatHive - Clean
- Threatsourcing - Clean
- Trustwave - Clean
- Underworld - Unrated
- URLhaus - Clean
- URLQuery - Unrated
- Viettel Threat Intelligence - Clean
- VIPRE - Unrated
- ViriBack - Clean
- VX Vault - Clean
- Webroot - Clean
- Xcitium Verdict Cloud - Clean
- Yandex Safebrowsing - Clean
- ZeroCERT - Clean
- ZeroFox - Unrated
Security Scans
Checked against the browser threat feeds available to this scan — no hit.
What we observed
Visual warning signs were identified
Centered dark card with red glow showing the brand 'TBELINK' and Russian subtitle 'Панель управления инвайт-системой', a 'Логин (admin)' field, a 'Пароль' field, a red 'Войти в аккаунт' button and small text 'TBE panel v2'. The page presents username and password inputs for an admin panel, inviting credential entry into an operator-controlled login form.
What the captured page showed
2 observations- 01
Centered dark card with red glow showing the brand 'TBELINK' and Russian subtitle 'Панель управления инвайт-системой', a 'Логин (admin)' field, a 'Пароль' field, a red 'Войти в аккаунт' button and small text 'TBE panel v2'.
- 02
The page presents username and password inputs for an admin panel, inviting credential entry into an operator-controlled login form.
What the page says about itself
Quoted from the pages we read: the site's own words, not our findings.
- Page title
TBELink — Admin Dashboard
Pages we read
- Main page/panelRead
03 · Investigation Story
Investigation story
What the site claims
TBELink — Admin Dashboard
What we observed
Saved browser evidence recorded cross domain landing.
What independent research found
5 external findings were saved and compared with the page evidence.
What remains unverified
1 of the 6 applicable core capabilities did not complete, so those gaps remain visible in the coverage ledger.
What kind of site and risk is this?
Threat category
Phishing & Impersonation
Service and business model
Login Portal
Observed behavior
Evidence behind this classification
- 01The page redirected the browser to an unrelated external domain.
- 02The panel generates links from selectable login-page templates in five languages with lifetimes of 1 to 168 hours, alongside iframe, base-path and ban-checker controls.
- 03No company, address, phone or policy page is shown; the only community contact is a Discord invite.
If this is a scam — what it means for you
What happens if you type credentials here
A visitor arriving at s.team-lw.com is moved to domain.tbegod.com/panel and met with an admin login form asking for a username and password. Anything typed there goes to whoever controls that panel, an operator with no disclosed identity.
If this is a scam, how it works
The evidence-backed path
Each stage below is preserved from the grounded analysis and linked to saved evidence.
The same panel is built to mint short-lived links from selectable login-page templates across five languages, so the links it produces can be pointed at pages that imitate sign-in screens elsewhere. The destination of any generated link is not shown on the page.
Do not enter any login or password on this address or on the panel it redirects to, and do not open links generated by it. If you reached s.team-lw.com from a message, treat that message as untrusted and delete it; if you already typed credentials into the TBELINK form, change that password wherever else you use it and enable two-factor authentication.
Web research findings
Independent findings for s.team-lw.com, including public complaints, named review sources, registration records, and look-alike-domain evidence.
- ScamAdviseropen
"This website has been classified as malicious by IPQS"
- ScamAdviseropen
"This website was reported by IPQS for phishing."
- ScamAdviseropen
"The registrar of this website is popular amongst scammers"
- ScamAdviseropen
"In summary, tbeelink.online has a very low trust score which indicates that there is a strong likelyhood the website is a scam."
Reputation Sources
How this domain rates across independent threat-intelligence and blocklist providers.
04 · Domain & Infrastructure
Domain & infrastructure
The plumbing behind the site — who registered it, how it’s encrypted, where it’s hosted, and where it links out. A valid certificate or a calm server doesn’t mean the business is honest — scam sites pass these checks too.
Infrastructure map
- Domains.team-lw.com
- Redirects todomain.tbegod.com
- Hosted byCloudflare, Inc.
- Referencesdiscord.gg · t.me
Domain Timeline
- Nov 4, 2026Domain registered
First appeared in WHOIS records — 1 day old when this review was saved.
- Nov 5, 2026Saved security review — Rated High Risk
The completed checks from this saved scan are detailed above.
s.team-lw.com was registered very recently when this review was saved and was already flagged. Freshly-registered domains are disproportionately used for scams, and a young domain with active threat signals warrants extra caution.
Contact Verification
Saved contact details can help identify the operator. Their presence supports traceability; it does not prove the business is trustworthy.
Domain & Encryption
Cloudflare DNS is used by legitimate and scam sites alike, so it does not identify who runs the site.
Report this domain to its registrar: send the address and what happened to this contact.
This is the certificate of domain.tbegod.com, the site this URL lands on. Certificate issued for tbegod.com.
A shared Cloudflare address answers for many sites, so it is not the site's own server and says nothing about who runs it. This is the address of domain.tbegod.com, the site this URL lands on.
Analytics and ads
- Cloudflare Web Analytics
Payment providers the page loads
None seen among the outside domains we saved.
Read from the first 20 outside domains the page loads and the shop platform it uses; the web server and platform rows are under Hosting & Technology. A payment script on the page does not prove the shop accepts that method at checkout, or that you are protected.
Redirect Chain
- 1301http://s.team-lw.com/
- 2307https://s.team-lw.com/
- 3200https://domain.tbegod.com/panelcross-domain
Server Reputation
Referenced Domains
Outbound domains this page links to or loads resources from. Each links to its own security scan.
05 · Evidence Ledger
Evidence ledger
- Antiviruspartial
- Browser threat feedcomplete
- Page contentcomplete
- Analysiscomplete
- Visual evidencecomplete
The conclusion is supported by the evidence saved with this report.
Technical threat
suspiciousMalware, phishing, credential theft and hostile infrastructure.
The panel generates links from selectable login-page templates in five languages with lifetimes of 1 to 168 hours, alongside iframe, base-path and ban-checker controls. · The destination presents an admin login and password form that collects credentials for an undisclosed operator.
Operator / customer risk
suspiciousComplaints, withdrawals, business conduct and commercial traps.
One public warning in public web research: "This website has been classified as malicious by IPQS" · The page redirected the browser to an unrelated external domain.
Source coverage and freshness
Status shows whether usable evidence was saved; finding shows what that evidence observed.
| Source | Result | Completion | Finding | Freshness |
|---|---|---|---|---|
| Antivirus | 0 of 97 engines flagged | Limited | No saved finding | stale fallback · analysed Aug 3, 2025 |
| Browser protection | No browser threat-list match | Completed | No adverse finding | this scan · Nov 5, 2026 |
| Page content | Page fetched · HTTP 200 | Completed | No adverse finding | this scan · Nov 5, 2026 |
| Visual evidence | 2 visible observations saved with the page capture | Completed | Adverse | this scan · Nov 5, 2026 |
| Independent research | 5 independent findings were saved | Completed | Adverse | this scan · Nov 5, 2026 |
- Antivirus
- Result0 of 97 engines flagged
- CompletionLimitedFindingNo saved finding
- Freshnessstale fallback · analysed Aug 3, 2025
- Browser protection
- ResultNo browser threat-list match
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
- Page content
- ResultPage fetched · HTTP 200
- CompletionCompletedFindingNo adverse finding
- Freshnessthis scan · Nov 5, 2026
- Visual evidence
- Result2 visible observations saved with the page capture
- CompletionCompletedFindingAdverse
- Freshnessthis scan · Nov 5, 2026
- Independent research
- Result5 independent findings were saved
- CompletionCompletedFindingAdverse
- Freshnessthis scan · Nov 5, 2026
07 · Safety FAQ
Safety FAQ
Answered from the saved verdict and evidence in this report.
Is s.team-lw.com a scam or a legit website?
Is s.team-lw.com safe to use?
I already paid or entered my details on s.team-lw.com — what should I do?
Can I get my money back from s.team-lw.com?
Did s.team-lw.com steal my password or personal information?
How do I report s.team-lw.com?
s.team-lw.com looks professional — how can it still be a scam?
Has s.team-lw.com been flagged by antivirus engines?
Is s.team-lw.com on any phishing or malware blacklists?
How old is the s.team-lw.com domain?
Does s.team-lw.com have a valid SSL certificate?
How often is the s.team-lw.com report updated?
08 · Final Verdict
Final verdict
A one-day-old domain that bounces visitors to a Russian-language admin panel for generating short-lived, template-based login links
s.team-lw.com hosts nothing of its own: it redirects the browser to https://domain.tbegod.com/panel, which shows a 'TBELINK' / 'TBE panel v2' login screen for an 'invite system' control panel. That panel's own menu offers link generation, domain management, 'Логинки (Шаблоны)' login-page templates, iframe and base-path settings, a ban checker and a domain-purchase item, with generated links lasting 1 to 168 hours in five languages. The parent domain was registered one day before the scan, and independent checks describe the domain as malicious and reported for phishing. Nothing here is a consumer product, so the score reflects the operator and infrastructure risk rather than a shop or payment flow.
09 · Community
Community
Are you the owner of s.team-lw.com?Verify and reply