join-meet[.]app

This domain is flagged as an active credential harvesting phishing site targeting users through deceptive login interfaces. Analysis indicates an elevated risk level due to its infrastructure and detection patterns, suggesting it is designed to capture sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. Infrastructure analysis reveals the domain join-meet.app was registered on April 18, 2026, through Porkbun LLC and currently resolves to the IP address 44.227.76.166. Security vendor detections on VirusTotal report 3 out of 95 engines flagging the domain as malicious. The domain appears on three security blocklists and is included in one AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, further corroborating its malicious classification. The page title, 'porkbun.com | parked domain,' suggests an attempt to mimic legitimate parking pages while concealing its true purpose. To mitigate risks associated with this credential harvesting phishing domain, organizations should immediately block the domain and its resolving IP address (44.227.76.166) at the network perimeter. Security teams are advised to monitor for any attempts to access join-meet.app within internal logs and alert users who may have interacted with the site. Given the domain's recent creation date and low detection rate, proactive threat hunting for related indicators of compromise (IOCs) is recommended. Users should be educated on recognizing phishing attempts, particularly those impersonating collaboration or meeting platforms, and encouraged to verify domain authenticity before entering credentials.