# PhishDestroy domain threat record: meet-setup.site

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/meet-setup.site/
Machine-readable companion: https://phishdestroy.io/domain/meet-setup.site/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-10-25 16:14:18 UTC
- Last availability or vendor check: 2026-10-25 16:45:07 UTC
- Stored record updated: 2026-10-25 20:49:50 UTC
- VirusTotal detections in the stored snapshot: 0/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Google

## Stored infrastructure

- Observed IP address: 188.114.97.3
- Registrar in stored WHOIS data: NAMECHEAP INC
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 200

## Evidence links

- URLScan report: https://urlscan.io/result/01a173f2-8fbc-742a-8edb-404fd54fe6e9/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/meet-setup.site
- Certificate Transparency search: https://crt.sh/?q=%25.meet-setup.site
- Web Archive lookup: https://web.archive.org/web/*/https://meet-setup.site/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
PhishDestroy’s intake AI flagged meet-setup.site as malicious because the page impersonates Google Meet, asks for microphone and camera access, and presents a “Sign in with Google” button on a non‑Google domain. The site was first observed by PhishDestroy on 2026-10-25, two days after its registration on 2026-10-23.

How the scam works
In this type of phishing, attackers host a page that mimics a legitimate service—in this case Google Meet—to lure victims into granting Google credentials or device permissions. The fake sign‑in flow captures the victim’s Google account credentials, and the requested media permissions can be abused for eavesdropping or further account takeover. The scheme relies on brand trust rather than any technical compromise of the legitimate service.

Evidence
VirusTotal scanned the domain on 2026-10-25 and reported 0 detections out of 92 engines. Google Safe Browsing checked the same day and did not flag the URL. External blocklists MetaMask and SEAL listed the domain, and PhishDestroy’s internal blocklist also contains it. OTX recorded three pulses mentioning the domain as of 2026-10-25. urlscan captured the page on 2026-10-25, returned a 200 response, and its machine‑learning engine gave a malicious verdict with a score of 100, categorising it as phishing and associating it with Google.

Infrastructure
The domain was registered with NameCheap on 2026-10-23 and is hosted behind Cloudflare, with recorded IP addresses 188.114.97.3 and 104.21.6.149. TLS was provided by Google Trust Services, valid for 90 days and covering the SAN meet-setup.site. The site uses Cloudflare’s CDN and WAF, and the page metadata claims the title “Google Meet”.

What to do
Users who entered Google credentials should change their Google password immediately and review recent account activity for unknown sign‑ins or OAuth grants, revoking any that appear suspicious. Organizations should block meet-setup.site at the DNS or proxy level, monitor logs for connections to the recorded IPs, and enforce multi‑factor authentication for Google accounts. Security teams can add the domain to internal blocklists and keep an eye on future registrations from the same registrar or hosting provider.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a173f2-8fbc-742a-8edb-404fd54fe6e9/
Cloudflare Radar report: https://radar.cloudflare.com/scan/696360ad-bc19-4c81-a651-40136e9cf5f6
Stored capture screenshot: https://i.ibb.co/Q0Cfttn/e2157fc8eed7.png
Cloudflare Radar screenshot (2026-10-25T16:22:11Z): https://screenshots.phishdestroy.io/cf/696360ad-bc19-4c81-a651-40136e9cf5f6.png
VirusTotal report: https://www.virustotal.com/gui/domain/meet-setup.site
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=meet-setup.site
Archived copy: https://web.archive.org/web/20261025161454/https://meet-setup.site/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-25 16:59:25 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/Q0Cfttn/e2157fc8eed7.png
  Captured: 2026-10-25 16:45:07 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a173f2-8fbc-742a-8edb-404fd54fe6e9.png
  Captured: 2026-10-25 16:45:07 UTC
  Source report: https://urlscan.io/result/01a173f2-8fbc-742a-8edb-404fd54fe6e9/
- URLScan capture 2: https://urlscan.io/screenshots/01a16d64-168b-75fe-9e50-af55fe3f6164.png
  Captured: 2026-10-25 16:14:18 UTC
  Source report: https://urlscan.io/result/01a173f2-8fbc-742a-8edb-404fd54fe6e9/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/696360ad-bc19-4c81-a651-40136e9cf5f6.png
  Captured: 2026-10-25 16:22:11 UTC
  Source report: https://radar.cloudflare.com/scan/696360ad-bc19-4c81-a651-40136e9cf5f6
  SHA-256: 47f5226fbb1d0c7ffac475ab5588b47ec420b307fead21dcb8bd143bf76b83fd
- URLQuery: https://screenshots.phishdestroy.io/uq/6f31b0bb-7d1b-4cef-a259-8f0f3128a04b.png
  Source report: https://urlquery.net/report/6f31b0bb-7d1b-4cef-a259-8f0f3128a04b
  SHA-256: 4aaf95f536ad525d51846a1637670e1054b553dff11226cbbbff1a61f4589813
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173e1-c28b-758c-b1f6-0c6797c07a06.png
  Captured: 2026-10-25 16:27:17 UTC
  Source report: https://urlscan.io/result/01a173e1-c28b-758c-b1f6-0c6797c07a06/
  SHA-256: 409930a39854b773dd68f80a3e4a7dcdf8793aa76bdeaf41553a5ed63e71a77c
- URLScan · 2026-10-25: https://screenshots.phishdestroy.io/us/01a173e8-260d-778a-b8f2-a98ba3e90c32.png
  Captured: 2026-10-25 16:32:41 UTC
  Source report: https://urlscan.io/result/01a173e8-260d-778a-b8f2-a98ba3e90c32/
  SHA-256: 0133af848f3073345b59fe078d756d876657e96ebe78a8557e3d3b0b645ce7a6

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-25T16:59:04Z",
        "uuid": "01a173f2-8fbc-742a-8edb-404fd54fe6e9",
        "scanned_at": "2026-10-25T16:44:04Z",
        "final_url": "https://meet-setup.site/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://meet-setup.site/",
                "from": "http://meet-setup.site/",
                "status": 307
            }
        ],
        "ip": "104.21.6.149",
        "domains": [
            "accounts.google.com",
            "fonts.gstatic.com",
            "static.cloudflareinsights.com",
            "fonts.googleapis.com"
        ],
        "ips": [
            "142.251.16.94",
            "104.16.79.73",
            "172.253.139.84",
            "172.253.122.95",
            "104.21.6.149"
        ],
        "asns": [
            "15169",
            "13335"
        ],
        "countries": [
            "US"
        ],
        "link_domains": [
            "workspace.google.com",
            "one.google.com",
            "support.google.com"
        ],
        "doc_hash": "1da4ca0dc31700d28cf4f5addbeb359d00abd298d4fd5be261e259f9d8c3d824",
        "globals": [
            "CLIENT_ID",
            "MAC",
            "MOBILE",
            "clicked",
            "gisReady",
            "tokenClient",
            "KEY_LIST",
            "KEY_CUR",
            "lsGet",
            "lsSet",
            "initial",
            "paintAvatar",
            "applyAccount",
            "showSignedOut",
            "saveAccount",
            "getList",
            "renderList",
            "openPop",
            "closePop",
            "decodeJwt",
            "onIdToken",
            "initGIS",
            "camStream",
            "toast",
            "__cfBeacon",
            "default_gsi",
            "_F_toggles_default_gsi",
            "google",
            "closure_lm_942545",
            "__G_ID_CLIENT__"
        ],
        "cookies": [
            "g_state"
        ],
        "storage_keys": [
            "__sak"
        ],
        "tls": {
            "san": [
                "meet-setup.site"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "WE1",
            "subject": "meet-setup.site",
            "protocol": "QUIC",
            "valid_to": "2027-01-21T19:03:54Z",
            "valid_from": "2026-10-23T18:03:56Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 90,
        "requests": 10,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 96,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "google"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Google"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=utf-8",
            "x-content-type-options": "nosniff",
            "referrer-policy": "strict-origin-when-cross-origin"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-25T16:22:47Z",
        "uuid": "696360ad-bc19-4c81-a651-40136e9cf5f6",
        "scanned_at": "2026-10-25T16:22:11Z",
        "final_url": "https://meet-setup.site/",
        "status": 200,
        "history": [
            {
                "url": "https://meet-setup.site/",
                "status": 200
            }
        ],
        "dom_hash": "d86b9c93c55f73b15ce298c7ee15288db4b91d74585bf5723dac646dbe1f3c1c",
        "doc_hash": "1da4ca0dc31700d28cf4f5addbeb359d00abd298d4fd5be261e259f9d8c3d824",
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks",
            "New Domains"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "meet-setup.site",
                "type": "A",
                "value": "172.67.134.231"
            },
            {
                "name": "meet-setup.site",
                "type": "A",
                "value": "104.21.6.149"
            },
            {
                "name": "meet-setup.site",
                "type": "AAAA",
                "value": "2606:4700:3035::6815:695"
            },
            {
                "name": "meet-setup.site",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:86e7"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.134.231",
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-23T18:34:16Z",
            "updated": "2026-10-23T18:46:35Z",
            "expires": "2027-10-23T18:34:16Z",
            "nameservers": [
                "maciej.ns.cloudflare.com",
                "ursula.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-25T16:54:48Z",
        "analysis_at": "2026-10-24T22:29:29Z",
        "stats": {
            "timeout": 0,
            "harmless": 55,
            "malicious": 0,
            "suspicious": 0,
            "undetected": 37
        },
        "reputation": 0,
        "registrar": "NAMECHEAP INC",
        "created": "2026-10-23T18:34:16Z",
        "expires": "2027-10-23T18:34:16Z",
        "updated": "2026-10-23T18:46:35Z",
        "first_seen": "2026-10-23T18:57:09Z",
        "dns": [
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.134.231"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward1.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.6.149"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:86e7"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward4.registrar-servers.com",
                "priority": 15
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward2.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "maciej.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "ursula.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "TXT",
                "value": "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward3.registrar-servers.com",
                "priority": 10
            },
            {
                "ttl": 300,
                "type": "MX",
                "value": "eforward5.registrar-servers.com",
                "priority": 20
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "maciej.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3035::6815:695"
            }
        ],
        "dns_at": "2026-10-24T22:36:57Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "meet-setup.site"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "938326160c0f7dcd13159e15a5c8505",
            "sha256": "dd4d3ee699a65c5ed74e0bcefb10990717c884bbec03dd66d0a88d947febd77c",
            "subject": "meet-setup.site",
            "valid_to": "2027-01-21T19:03:54Z",
            "valid_from": "2026-10-23T18:03:56Z"
        },
        "whois": {
            "registrar": "NAMECHEAP INC",
            "registrar_iana_id": "1068",
            "registrar_url": "http://www.namecheap.com",
            "created": "2026-10-23T18:34:16Z",
            "updated": "1-01-01T00:00:00Z",
            "expires": "2027-10-23T18:34:16Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited"
            ],
            "nameservers": [
                "maciej.ns.cloudflare.com",
                "ursula.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        },
        "rdap": {
            "status": [
                "client transfer prohibited"
            ],
            "events": {
                "registration": "2026-10-23T18:34:16Z",
                "registrar expiration": "2027-10-23T18:34:16Z",
                "last update of RDAP database": "2026-10-23T18:56:59Z"
            }
        }
    },
    "webcheck": {
        "v": 1,
        "fetched_at": "2026-10-25T16:24:10Z",
        "mail_config": {
            "mx": [
                "eforward5.registrar-servers.com",
                "eforward1.registrar-servers.com",
                "eforward2.registrar-servers.com",
                "eforward3.registrar-servers.com",
                "eforward4.registrar-servers.com"
            ],
            "spf": "v=spf1 include:spf.efwd.registrar-servers.com ~all",
            "spf_lookups": 1
        },
        "caa_records": {
            "domain": "meet-setup.site"
        },
        "block_lists": {
            "resolvers": 12,
            "blocked_count": 0
        },
        "archives": {
            "last": "2026-10-25T16:14:54Z",
            "first": "2026-10-25T16:14:54Z",
            "changes": 0,
            "days_archived": 1,
            "avg_page_bytes": 7214
        },
        "social_tags": {
            "ogUrl": "https://meet-setup.site",
            "title": "Google Meet",
            "ogType": "website",
            "ogImage": "https://meet-setup.site/og.png",
            "ogTitle": "Google Meet",
            "ogSiteName": "Google Meet",
            "themeColor": "#ffffff",
            "description": "Visioconférences sécurisées, en haute définition. Téléchargez l'application Google Meet pour Windows et macOS.",
            "twitterCard": "summary_large_image",
            "ogDescription": "Visioconférences sécurisées, en haute définition"
        },
        "trackers": {
            "requests": 8,
            "trackers": [
                {
                    "name": "Google Fonts",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 1
                },
                {
                    "name": "Google Static",
                    "company": "Google",
                    "country": "US",
                    "category": "Hosting",
                    "requests": 2
                },
                {
                    "name": "Google Accounts",
                    "company": "Google",
                    "country": "US",
                    "category": "Utilities",
                    "requests": 1
                }
            ]
        },
        "mixed_content": {
            "no_sri": [
                "https://accounts.google.com/gsi/client"
            ],
            "third_party_scripts": 1
        },
        "status": {
            "up": true,
            "code": 200,
            "timings": {
                "dns": 26,
                "tls": 19,
                "wait": 163,
                "connect": 65,
                "download": 0
            },
            "response_ms": 273
        },
        "tls_connection": {
            "alpn": "h2",
            "cipher": "TLS_AES_256_GCM_SHA384",
            "protocol": "TLSv1.3",
            "versions": [
                "TLSv1.2",
                "TLSv1.3"
            ],
            "authorized": true,
            "forward_secrecy": true
        },
        "ports": {
            "open": [
                80,
                443,
                8080
            ]
        },
        "carbon": {
            "bytes": 27370,
            "co2_grams": 0.001,
            "cleaner_than": 50
        },
        "dns_server": {
            "ns": [
                {
                    "ip": "172.64.34.191",
                    "host": "ursula.ns.cloudflare.com"
                },
                {
                    "ip": "108.162.195.42",
                    "host": "maciej.ns.cloudflare.com"
                }
            ],
            "zone": "meet-setup.site"
        },
        "cookies": {
            "cookies": [
                {
                    "name": "g_state"
                }
            ]
        },
        "location": {
            "ip": "2a06:98c1:3121::3",
            "asn": "13335",
            "org": "CloudFLARENET-EU",
            "city": "London",
            "country": "GB"
        },
        "ssl": {
            "issuer": "Google Trust Services / WE1",
            "subject": "meet-setup.site"
        },
        "dns": {
            "A": [
                "188.114.97.3",
                "188.114.96.3"
            ],
            "MX": [
                "{\"exchange\": \"eforward5.registrar-servers.com\", \"priority\": 20}",
                "{\"exchange\": \"eforward4.registrar-servers.com\", \"priority\": 15}",
                "{\"exchange\": \"eforward3.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward1.registrar-servers.com\", \"priority\": 10}",
                "{\"exchange\": \"eforward2.registrar-servers.com\", \"priority\": 10}"
            ],
            "NS": [
                "maciej.ns.cloudflare.com",
                "ursula.ns.cloudflare.com"
            ],
            "SOA": "{\"nsname\": \"maciej.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418305178, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}",
            "TXT": [
                "v=spf1 include:spf.efwd.registrar-servers.com ~all"
            ],
            "AAAA": [
                "2a06:98c1:3121::3",
                "2a06:98c1:3120::3"
            ]
        },
        "dnssec": {
            "ds": false,
            "rrsig": false,
            "dnskey": false
        },
        "hsts": {
            "message": "Site does not serve any HSTS headers."
        },
        "http_security": {
            "xFrameOptions": false,
            "referrerPolicy": "strict-origin-when-cross-origin",
            "xXSSProtection": false,
            "permissionsPolicy": false,
            "xContentTypeOptions": "nosniff",
            "contentSecurityPolicy": false,
            "strictTransportPolicy": false,
            "crossOriginOpenerPolicy": false,
            "crossOriginEmbedderPolicy": false,
            "crossOriginResourcePolicy": false
        },
        "firewall": {
            "waf": "Cloudflare",
            "has_waf": true
        },
        "get_ip": {
            "ip": "2a06:98c1:3121::3",
            "family": 6
        },
        "redirects": {
            "chain": [
                "https://meet-setup.site"
            ]
        },
        "linked_pages": {
            "external": [
                "https://workspace.google.com/pricing.html",
                "https://one.google.com/about/plans",
                "https://support.google.com/meet/answer/10452727"
            ],
            "external_count": 3,
            "internal_count": 1
        },
        "whois": {
            "registrar": "NameCheap, Inc.",
            "created": "2026-10-23T18:34:16Z",
            "updated": "2026-10-23T18:46:35Z",
            "expires": "2027-10-23T18:34:16Z",
            "status": [
                "clientTransferProhibited https://icann.org/epp",
                "addPeriod https://icann.org/epp"
            ],
            "nameservers": [
                "maciej.ns.cloudflare.com",
                "ursula.ns.cloudflare.com"
            ]
        },
        "headers": {
            "headers": {
                "server": "cloudflare",
                "content-type": "text/html; charset=utf-8",
                "x-content-type-options": "nosniff",
                "referrer-policy": "strict-origin-when-cross-origin"
            }
        }
    }
}
```