public company · US
Alphabet Inc.
Search, Gmail and cloud services.
- Primary official domain
- google.com
- Reviewed official domains
- 5 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
125
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
5
domains first source-reported within 30 days
First observed, 30 days
145
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF ~all · 1/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-20 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- gmailgoogleyoutube
- Label aliases
- Gmail · Google · YouTube
- Official domains
- abc.xyz · google.com · gmail.com · goo.gl · youtube.com (all)
- Generated spellings
- 400 tracked · 114 observed somewhere · 286 not observed (all)
- Can receive mail
- 43 spellings and 25 reported domains publish MX records · mail at Google 10 · Microsoft 365 5 · Above.com parking (parking placeholder) 4 · 40 more (114 spellings and 125 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
chromeuk-google[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.44.224CloudflareCloudflare (AS13335) · US172.67.204.36CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:2ce0CloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:cc24CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
chromeus-google[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.85.136CloudflareCloudflare (AS13335) · US172.67.206.107CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:5588CloudflareCloudflare (AS13335) · US2606:4700:3036::ac43:ce6bCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
pay-bitrefill[.]com-utmsource-google-campaign-5645542-keyword-bitrefill[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
google[.]comunicazioni-sicure[.]itMail: MXSPFDMARC · checked 2026-10-19mail at pmail.comunicazioni-sicure.it · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive34.240.138.155Amazon Web ServicesAmazon Web Services (AS16509) · USec2-34-240-138-155.eu-west-1.compute.amazonaws.com52.48.92.206Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-48-92-206.eu-west-1.compute.amazonaws.com54.77.191.63Amazon Web ServicesAmazon Web Services (AS16509) · USec2-54-77-191-63.eu-west-1.compute.amazonaws.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
conference-google-meet[.]liveMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.24.2CloudflareCloudflare (AS13335) · US172.67.214.192CloudflareCloudflare (AS13335) · US2606:4700:3031::6815:1802CloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:d6c0CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
cyrca-inc-googlemeet-interview[.]coMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive216.198.79.1Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
delegations-google[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARC · checked 2026-10-19mail at mail.delegations-google.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive179.236.79.48 · Confirmed phishing host address (DomainSpoof, 48 hours)HostingerHostinger (AS47583) · CYmail.delegations-google.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
deviceverify-google[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.13.67CloudflareCloudflare (AS13335) · US172.67.198.152CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:c698CloudflareCloudflare (AS13335) · US2606:4700:3031::6815:d43CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
docs-google[.]comMail: MXSPFDMARC · checked 2026-10-19mail at SendGrid (sending service) · DMARC policy none (monitor only) · sends via cyberriskaware.com, Mailgun | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive150.171.109.74Microsoft AzureMicrosoft Azure (AS8075) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google-jobs-verify[.]esk-sic[.]deMail: MXSPFDMARC · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · DMARC policy quarantine · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive67.205.154.99 · Confirmed phishing host address (DomainSpoof, 48 hours)DigitalOceanDigitalOcean (AS14061) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
accounts[.]google[.]cygn[.]eu[.]org2 hostnames under eu.orgMail: MXSPFDMARC · checked 2026-10-19mail at smtp.eu.org · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.91.36CloudflareCloudflare (AS13335) · US172.67.209.130CloudflareCloudflare (AS13335) · US2606:4700:3031::6815:5b24CloudflareCloudflare (AS13335) · US2606:4700:3033::ac43:d182CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:10 UTC | 1 source · 1 record | Details |
meet[.]googleapps[.]eu[.]org | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive66.33.60.130Amazon Web ServicesAmazon Web Services (AS16509) · US76.76.21.61Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google-apk[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.59.34CloudflareCloudflare (AS13335) · US172.67.211.241CloudflareCloudflare (AS13335) · US2606:4700:3035::6815:3b22CloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:d3f1CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google-dou-james5475[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
google-finance-aibot[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.35.160CloudflareCloudflare (AS13335) · US172.67.177.160CloudflareCloudflare (AS13335) · US2606:4700:3032::ac43:b1a0CloudflareCloudflare (AS13335) · US2606:4700:3036::6815:23a0CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google-flights[.]club2 hostnames under google-flights.clubMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
www[.]google-flights[.]club | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
google-meet-call[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
google-meet[.]globalMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive153.75.86.243 · Confirmed phishing host address (DomainSpoof, 48 hours)ROUTERHOSTING (AS14956) · USchecked 2026-10-20 05:05 UTC | 1 source · 1 record | Details |
google-miner[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.81.58CloudflareCloudflare (AS13335) · US172.67.157.43CloudflareCloudflare (AS13335) · US2606:4700:3032::ac43:9d2bCloudflareCloudflare (AS13335) · US2606:4700:3035::6815:513aCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google-playstore[.]clickMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive185.158.133.1CloudflareCloudflare (AS13335) · USlovable-app-cd-1-4.p.l5e.iochecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google-review-management[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.60.106CloudflareCloudflare (AS13335) · US172.67.195.201CloudflareCloudflare (AS13335) · US2606:4700:3032::ac43:c3c9CloudflareCloudflare (AS13335) · US2606:4700:3033::6815:3c6aCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
us[.]google-reviewcards[.]comMail: SPF · blocklist.de attackers (all services), blocklist.de mail attackersDMARC · checked 2026-10-19DMARC policy none (monitor only) · sends via IONOS | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive185.158.133.1CloudflareCloudflare (AS13335) · USlovable-app-cd-1-4.p.l5e.iochecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
| 4 names with the very common brand name 'gmail' (shown on request) | ||||||
125 registrable domains · 127 hostnames · page 2 of 5← PreviousNext →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.