live-join-gooqle-meet[.]4-c4[.]com

This domain, live-join-gooqle-meet.4-c4.com, is identified as a brand impersonation threat targeting Google’s video conferencing service, Google Meet. Analysis indicates the infrastructure was designed to deceive users into believing they were accessing legitimate Google Meet services, as evidenced by the page title 'Google Meet - Online Video Calls, Meetings and Conferencing.' No drainer kit signatures were detected, but the domain’s structure and naming convention strongly suggest intent to harvest credentials or distribute malicious payloads under the guise of a trusted brand. Infrastructure analysis reveals the following technical indicators: the domain was registered on May 21, 2026, through TuringSign Inc. d/b/a Cosmotown and resolves to the IP address 188.114.97.3. The SSL certificate is issued by Google Trust Services (WE1), which may have been leveraged to enhance the appearance of legitimacy. As of the latest assessment, 12 out of 95 security vendors on VirusTotal flag this domain as malicious. The domain appears on one security blocklist, though it is not currently listed on Google Safe Browsing (GSB). The creation date suggests the domain was set up with a future activation timeline, potentially to evade immediate detection. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure remains registered and could be reactivated. Response actions should include monitoring for re-emergence, notifying the registrar (TuringSign Inc.) for potential suspension under abuse policies, and updating blocklists to prevent future access. Remaining risks include the possibility of the threat actor reusing the infrastructure or repurposing the SSL certificate for other malicious domains. Users and organizations are advised to block the domain and IP at the network level and conduct retroactive log analysis to identify any prior interactions with this infrastructure.