us05web-meet[.]com

The domain us05web-meet.com was registered on 21 February 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is currently hosted on the IP address 101.99.93.38, which resolves to an autonomous system (AS45839) owned by Shinjiru Technology Sdn Bhd in Bulgaria. DNS records point to the authoritative nameservers ns1.aitscb.com and ns2.aitscb.com. The web server reports an Apache HTTP Server banner and presents a TLS certificate issued by Let’s Encrypt (R13), indicating that encrypted connections are available. An HTTP GET returns status code 200 and the sole page title is “Index of /”, suggesting a directory listing without additional content.

The site is classified as a brand‑impersonation campaign targeting Google, and the risk level is marked high with an active status. VirusTotal analysis shows that six of ninety‑three scanning engines have flagged the domain, and three independent blocklists already list it. Commercial filtering services such as PhishDestroy, MetaMask and SEAL have also blocked the domain. The Gridinsoft trust score is 0 out of 100, reinforcing the malicious assessment.

No further payload or credential‑harvesting pages have been observed in the public data, so the exact phishing kit or content remains unknown. Defenders should continue to block the domain at perimeter and DNS layers, monitor outbound connections to the associated IP range, and add the domain and its nameservers to threat‑intel feeds. Given the active status and high risk rating, security teams should also consider automated sandbox retrieval of the site content to verify any future changes. Continuous re‑scanning with VirusTotal or similar services is advised to capture additional detections as the campaign evolves.