Google-services phishing page on rsvp.digitalmeet-team.com seen in New Zealand and Australia
Threat Intelligence (threatintel.co.nz) reported on 23 October 2026 a new phishing campaign circulating in New Zealand and Australia that impersonates Google services with a carefully crafted webpage. It says the doma…
- First reported
- Reports
- 1
Source: threatintel.co.nz · published
What happened
Threat Intelligence (threatintel.co.nz) reported on 23 October 2026 a new phishing campaign circulating in New Zealand and Australia that impersonates Google services with a carefully crafted webpage. It says the domain digitalmeet-team.com was first registered on 21 October 2026; the subdomain rsvp.digitalmeet-team.com, pointing to an AWS-hosted IP address in Sweden, is the primary phishing URL, while the root domain points to a US IP hosted by TierraNet Inc and shows only a default landing page. The report advises organisations to block the indicators and users to check the destination domain before entering credentials or approving authentication requests.
How the scam works
Phishing pages that imitate Google services usually aim to collect a Google account email and password, and sometimes a one-time code, so the attackers can take over Gmail, Drive and any other services linked to the account. A link to the page typically arrives in an email or message that looks like a meeting invitation, an RSVP request, a shared document or a security alert. The subdomain 'rsvp' fits that kind of lure. Threat Intelligence says the campaign stands out because of how much effort went into making the page look legitimate, and because campaigns targeting Google services are relatively uncommon in New Zealand at present.
The report warns that convincing design and legitimate-looking branding mean people can no longer rely on spelling mistakes or poor layouts to spot a fake. The safest check is the address bar: Google sign-in happens on accounts.google.com, not on other domains. Google is impersonated and is not involved.
Source
Threat Intelligence (threatintel.co.nz), "New Phishing Campaign Targeting Google Services Seen Locally" (published 23 October 2026).
Red flags
- An unexpected invitation, RSVP or shared-document link that asks you to sign in with Google.
- A sign-in page on a domain such as digitalmeet-team.com instead of accounts.google.com.
- Requests to approve a login or enter a code you didn't start.
- A very polished page reached from a link in an email or message.
If you were targeted
- 1Don't enter your Google password or codes on pages reached from unexpected links.
- 2Open Google services by typing the address yourself or using the official app.
- 3If you entered your password, change it immediately and review recent security activity in your Google account.
- 4Turn on two-step verification, preferably with a passkey or security key.
- 5Organisations should block digitalmeet-team.com and check DNS and proxy logs for connections to it.
- 6Report the email or message to your IT team or email provider.