googlemeeeeet.live
172.67.134.96AS13335 · USthis page sends its visitors on to https://googlemeeeeet.live/microsoft-store.php, which declares a download address (https://googlemeeeeet.live/download.php); opening it, with nothing pressed, handed our browser an executable file ("googlemeet_agent_3.24.exe")
- Threat Intelligence● malicious
- Browser Analysis● malicious
- Delivered file● malicious
- Network & Hosting● clean
- Related Infrastructure● clean
- Domain Intelligence● unknown
- TLS Fingerprint● unknown
Dangerous — confirmed threat
Automated- 01It presents itself as Google while being hosted somewhere Google does not own.
- 02After a short wait it sends you on to another page on the same site (https://googlemeeeeet.live/microsoft-store.php), and that page hands over a program to run on your computer.
- 03It is listed on external threat-intelligence feeds.
- 04The file it serves was analysed and found malicious.
What to do
Do not enter any information or download anything. If you already did, change those passwords now and contact your bank if payment details were involved. Block or report the link to your team.
This reflects the evidence found at the time of the scan. If you believe it is a mistake, you can escalate it for analyst review.
What happened
Step by step, from what the scanner recorded.Findings
Strongest firstWe analysed the file this page delivered — it is Malicious.
Success
SHA-256 8afc44eedd04647d8adacb17058a8ee1f94259d761808dec6ffb3ef22d49821f
The page we scanned shows a wait screen and names one page on its own site as where it is about to send the visitor. We opened that page in our browser. It handed nothing over by itself; it declares a download address (https://googlemeeeeet.live/download.php) that a visitor reaches by pressing its download control. We opened that address — nothing was pressed — and it handed us a file — "googlemeet_agent_3.24.exe" from https://googlemeeeeet.live/download.php. brand impersonation (Google, high)
Analyst noteWe hold this file — it was delivered to our browser, so the file analysis on this scan is of the real payload rather than of the page. Nothing was clicked: we opened the download address the second page declares, the one its own control saves for a visitor who presses it. The submitted address only leads there, which is why it looks empty on its own.
The file this page handed over describes itself, in its own ProductName, as "Zecurit Agent" — Zecurit's agent — under a download name that says nothing about it. Remote-management tools are legitimate software; what makes this an attack is that the visitor was given one under a different pretext, so the attacker ends up with remote control of the machine.
Analyst noteThis name came out of the delivered bytes themselves — nothing opened or unpacked the file, so treat it as a strong hint about WHICH tool, not as proof of what the installer does. The page offered an update and the download is named after it, which is why neither mentions Zecurit. ⚠️ Expect the installer to be signed and to analyse Clean, because it IS the real product; the abuse is the pretext and the tenant it enrols into. Check that tenant before assuming it is not yours.
The page presents itself as a known brand (brand keywords/branding detected).
Analyst noteHigh confidence: the host wears the brand's name and the brand does not own it.
File
Stored by the engineWhat you download may be live malware. Open it only in an isolated environment, and do not double-click it.
The ZIP is encrypted. Password:infected
Inside the ZIP the file carries a name the engine generated, not the one the page used.
Delivered fileMaliciousgooglemeet_agent_3.24.exe
SHA-2568afc44eedd04647d8adacb17058a8ee1f94259d761808dec6ffb3ef22d49821f
Fromhxxps://googlemeeeeet[.]live/download[.]php
Infrastructure
- IP
- 172.67.134.96CLOUDFLARENET - Cloudflare, Inc., US · AS13335US
- TLS
- CN=WE1, O=Google Trust Services, C=US · expires Jan 24, 2027
- Redirects
- 1 hop · / → /invite.php
WHOIS
- Registrar
- NameSilo, LLC
- Created
- Jul 27, 2026
- Expires
- Jul 27, 2027
- Nameservers
- sri.ns.cloudflare.comleanna.ns.cloudflare.com
Hashes & fingerprints
Page capture
LiveTitle “Google Meet Mockup - Windows” · brand shown: Google (high)
Engines
7 · time to verdictPage
- HTTP
- 200 · Completed
- Title
- Google Meet Mockup - Windows
- Load
- 10.05 s · 7 requests