conference-google-meet[.]live

This domain, conference-google-meet.live, is actively impersonating Google Meet infrastructure as of July 12, 2026. Registered on April 29, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain resolves to 188.114.97.3, an IP address geolocated to Canada and associated with Cloudflare. The site returns a 200 HTTP status, indicating an operational web server, and presents a page titled 'Meet - acw-doms-ifw,' which aligns with common brand impersonation tactics targeting video conferencing platforms. Analysis indicates the domain is designed to exploit trust in Google's services, likely for credential harvesting or malware distribution. It is flagged by 20 out of 95 security vendors on VirusTotal and appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The domain has also been documented in one AlienVault OTX threat intelligence pulse, suggesting it has drawn attention from multiple security communities. The use of Cloudflare and Let's Encrypt SSL certificates (serial number E7) is consistent with adversaries attempting to lend legitimacy to malicious infrastructure, while detected technologies such as PHP and Cloudflare Browser Insights may facilitate dynamic content delivery or user tracking. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and cross-vendor detections. The domain's registration age of approximately two and a half months does not mitigate its threat level, as many phishing campaigns operate within this timeframe. Network-level blocking of 188.114.97.3 and the domain itself is recommended, along with monitoring for related subdomains or newly registered lookalike domains. Security teams should also inspect logs for connections to this IP or domain, particularly from endpoints where Google Meet or other collaboration tools are in use. Given the domain's persistence and technical indicators, it is likely part of a broader campaign rather than an isolated incident.