webinvitemeeting[.]com

webinvitemeeting.com is flagged as a banking phishing infrastructure that was taken offline as of the report date. The domain was registered on 28 September 2025 through Global Domain Group LLC and resolves to the IPv4 address 89.163.155.33, which is announced by AS24961 WIIT AG and geolocated in Germany. DNS resolution uses the authoritative nameservers ns7.privatedns.vip and ns8.privatedns.vip, and the sole MX record points to the domain itself, a pattern often observed in phishing campaigns that attempt to receive victim‑generated emails. The web service presents the generic directory index title “Index of /” and is served by Nginx with HTTP/3 support, indicating a modern server stack.

The site employs a Let’s Encrypt R12 certificate, which confirms the presence of TLS but offers no validation of the site’s legitimacy. Infrastructure reputation is extremely low: Gridinsoft assigns a trust score of 0 out of 100, and the domain appears on one public blocklist. Threat‑intel aggregators have recorded activity: AlienVault OTX references the domain in 44 separate pulses, and PhishDestroy has actively blocked it. VirusTotal scans show eight of ninety‑three security vendors flagging the domain, reinforcing the malicious rating.

The classification as “Banking Phishing” derives from the provided intelligence, though no payload or landing‑page details are available, leaving the exact phishing technique and targeted financial institution undefined. Defenders should immediately add the domain and its IP address to blocklists, enforce DNS sink‑holing, and monitor for any resurgence of the infrastructure. Continued observation of the associated ASN and any future SSL certificate changes is advised, as attackers may redeploy the same hosting environment under a new domain.