A new phishing campaign has been observed circulating in New Zealand and Australia, impersonating Google services through a convincing and carefully crafted webpage. The campaign stands out due to the effort put into making the phishing infrastructure appear legitimate, as well as its focus on Google services, which is relatively uncommon in current campaigns observed locally.
The domain digitalmeet-team[.]com was first registered on 21 October 2026.
Technical analysis shows that the root domain, www.digitalmeet-team[.]com, points to a US-based IP address hosted by TierraNet Inc. However, it currently displays only the hosting provider’s default landing page. The rsvp.digitalmeet-team[.]com subdomain points to an AWS-hosted IP address in Sweden and is currently the primary subdomain being used in the phishing campaign.
Indicators of Compromise (IOCs)
| Indicator | Details |
|---|---|
| Domain | digitalmeet-team[.]com |
| Primary phishing URL | rsvp[.]digitalmeet-team[.]com |
| Root domain | www[.]digitalmeet-team[.]com |
| Registration date | 21 October 2026 |
| Hosting infrastructure | TierraNet Inc (US) and AWS (Sweden) |
Why this campaign stands out
The combination of a newly registered domain, geographically distributed hosting infrastructure and a well-crafted imitation of Google services makes this campaign noteworthy. Its presentation may help it appear credible to recipients who are accustomed to legitimate Google-branded communications.
Organisations should consider reviewing DNS and web proxy logs for connections to the identified domain and blocking the indicators where appropriate. Users should also be reminded to verify the destination domain before entering credentials or approving authentication requests.
As phishing campaigns continue to evolve, organisations should avoid relying solely on obvious spelling mistakes or poorly designed webpages to identify malicious activity. Convincing presentation and legitimate-looking branding can be used to make credential theft attempts harder to recognise.
