public company · US
Alphabet Inc.
Search, Gmail and cloud services.
- Primary official domain
- google.com
- Reviewed official domains
- 5 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
118
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
5
domains first source-reported within 30 days
First observed, 30 days
138
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
Not checked
No email-policy check yet
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- gmailgoogleyoutube
- Label aliases
- Gmail · Google · YouTube
- Official domains
- abc.xyz · google.com · gmail.com · goo.gl · youtube.com (all)
- Generated spellings
- 400 tracked · 114 observed somewhere · 286 not observed (all)
- Can receive mail
- 40 spellings and 23 reported domains publish MX records · mail at Google 10 · Microsoft 365 5 · Above.com parking (parking placeholder) 4 · 35 more (95 spellings and 118 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
google[.]apple-cl0ud[.]comMail: MXSPFDMARC · checked 2026-10-19mail at pmail.apple-cl0ud.com · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive34.240.138.155Amazon Web ServicesAmazon Web Services (AS16509) · USec2-34-240-138-155.eu-west-1.compute.amazonaws.com52.48.92.206Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-48-92-206.eu-west-1.compute.amazonaws.com54.77.191.63Amazon Web ServicesAmazon Web Services (AS16509) · USec2-54-77-191-63.eu-west-1.compute.amazonaws.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
google[.]comunicazioni-sicure[.]itMail: MXSPFDMARC · checked 2026-10-19mail at pmail.comunicazioni-sicure.it · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive34.240.138.155Amazon Web ServicesAmazon Web Services (AS16509) · USec2-34-240-138-155.eu-west-1.compute.amazonaws.com52.48.92.206Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-48-92-206.eu-west-1.compute.amazonaws.com54.77.191.63Amazon Web ServicesAmazon Web Services (AS16509) · USec2-54-77-191-63.eu-west-1.compute.amazonaws.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
delegations-google[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at mail.delegations-google.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive179.236.79.48 · Confirmed phishing host address (DomainSpoof, 14 days)HostingerHostinger (AS47583) · CYmail.delegations-google.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
docs-google[.]comMail: MXSPFDMARC · checked 2026-10-19mail at SendGrid (sending service) · DMARC policy none (monitor only) · sends via cyberriskaware.com, Mailgun | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive150.171.110.7Microsoft AzureMicrosoft Azure (AS8075) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
ecpa49-gmail[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Webador (web / mail hosting) · DMARC policy none (monitor only) · sends via Webador | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive35.204.150.5Google CloudGoogle Cloud (AS396982) · US5.150.204.35.bc.googleusercontent.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
google-jobs-verify[.]esk-sic[.]deMail: MXSPFDMARC · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · DMARC policy quarantine · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive67.205.154.99 · Confirmed phishing host address (DomainSpoof, 14 days)DigitalOceanDigitalOcean (AS14061) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
accounts[.]google[.]cygn[.]eu[.]org2 hostnames under eu.orgMail: MXSPFDMARC · checked 2026-10-19mail at smtp.eu.org · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.91.36CloudflareCloudflare (AS13335) · US172.67.209.130CloudflareCloudflare (AS13335) · US2606:4700:3031::6815:5b24CloudflareCloudflare (AS13335) · US2606:4700:3033::ac43:d182CloudflareCloudflare (AS13335) · USchecked 2026-10-19 11:00 UTC | 1 source · 1 record | Details |
meet[.]googleapps[.]eu[.]org | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive66.33.60.34Amazon Web ServicesAmazon Web Services (AS16509) · US76.76.21.164Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
gmail-transfer[.]comMail: MXSPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at gmail-transfer.com · DMARC policy none (monitor only) · sends via MailChannels | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive159.100.6.19ULTAHOST-AS (AS214036) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
googleinterviewmeetingmeet[.]liveMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at googleinterviewmeetingmeet.live · DMARC policy none (monitor only) · sends via MailChannels | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.225.128.78 · Confirmed phishing host address (DomainSpoof, 14 days)SHOCK-1 (AS395092) · USfl-s1.serverpanel.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
googlemeeting[.]usMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at googlemeeting.us · DMARC policy none (monitor only) · sends via MailChannels | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.225.128.78 · Confirmed phishing host address (DomainSpoof, 14 days)SHOCK-1 (AS395092) · USfl-s1.serverpanel.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
googleripple[.]comMail: MXSPFDMARC · checked 2026-10-19mail at mail.googleripple.com · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.16.121CloudflareCloudflare (AS13335) · US172.67.212.86CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:d456CloudflareCloudflare (AS13335) · US2606:4700:3037::6815:1079CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
google-verify[.]highlatch[.]comMail: MXSPFDMARC · checked 2026-10-19mail at _dc-mx.9fa3e2a568ac.highlatch.com · DMARC policy none (monitor only) · sends via Hostinger | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
meetgoogle[.]ruMail: MX · Confirmed phishing host address (DomainSpoof, 14 days) · checked 2026-10-19mail at mx.meetgoogle.ru | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.124.226.115 · Confirmed phishing host address (DomainSpoof, 14 days)VDSINA (AS216071) · AEv777174.hosted-by-vdsina.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
gmail-account-recovery[.]microtool[.]devMail: MXSPF · checked 2026-10-19mail at Cloudflare Email Routing (mail forwarding) · sends via Cloudflare Email Routing | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.0.172CloudflareCloudflare (AS13335) · US172.67.128.36CloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:8024CloudflareCloudflare (AS13335) · US2606:4700:3037::6815:acCloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
proservicealademande971-gmail[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Webador (web / mail hosting) · DMARC policy none (monitor only) · sends via Webador | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive35.204.150.5Google CloudGoogle Cloud (AS396982) · US5.150.204.35.bc.googleusercontent.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
google-for-jobs-verify[.]schilling-domke[.]deMail: MXSPF · blocklist.de attackers (all services), blocklist.de mail attackersDMARC · checked 2026-10-19mail at IONOS (web / mail hosting) · DMARC policy none (monitor only) · sends via IONOS | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive67.205.154.99 · Confirmed phishing host address (DomainSpoof, 14 days)DigitalOceanDigitalOcean (AS14061) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
sites1-google[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Webador (web / mail hosting) · DMARC policy none (monitor only) · sends via Webador | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive35.204.150.5Google CloudGoogle Cloud (AS396982) · US5.150.204.35.bc.googleusercontent.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
support-google[.]plMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at support-google.pl · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive85.128.244.69 · Confirmed phishing host address (DomainSpoof, 14 days)NETARTGROUP (AS15967) · PLshared-aoi69.rev.nazwa.plchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
updates-google[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at mail.updates-google.com · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive64.181.217.59 · Confirmed phishing host address (DomainSpoof, 14 days)Oracle CloudOracle Cloud (AS31898) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
youtubeayed[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Zoho (consumer mailbox) · DMARC policy none (monitor only) · sends via Zoho, Hostinger | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.16.174CloudflareCloudflare (AS13335) · US172.67.214.228CloudflareCloudflare (AS13335) · US2606:4700:3034::ac43:d6e4CloudflareCloudflare (AS13335) · US2606:4700:3035::6815:10aeCloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
accounts[.]google[.]login[.]secure[.]id[.]google[.]com[.]zkey0[.]comMail: MX · checked 2026-10-19mail at Google (consumer mailbox) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.23.171CloudflareCloudflare (AS13335) · US172.67.212.92CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:d45cCloudflareCloudflare (AS13335) · US2606:4700:3036::6815:17abCloudflareCloudflare (AS13335) · USchecked 2026-10-19 11:00 UTC | 1 source · 1 record | Details |
tracking[.]email[.]zugangmailer[.]deMail: MXSPFDMARC · checked 2026-10-19mail at mail.zugangmailer.de · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive18.198.163.56Amazon Web ServicesAmazon Web Services (AS16509) · USec2-18-198-163-56.eu-central-1.compute.amazonaws.com18.198.218.66Amazon Web ServicesAmazon Web Services (AS16509) · USec2-18-198-218-66.eu-central-1.compute.amazonaws.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
google[.]com[.]pyMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy reject | Reported by PhishTankAbsent from latest snapshot | Possible associationBrand in hostname | 2026-10-14Source reported | Alive172.253.63.94GoogleGoogle (AS15169) · USbi-in-f94.1e100.net2607:f8b0:4004:c08::5eGoogleGoogle (AS15169) · USbi-in-f94.1e100.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
23 registrable domains · 24 hostnames · page 1 of 1
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.