public company · US
Alphabet Inc.
Search, Gmail and cloud services.
- Primary official domain
- google.com
- Reviewed official domains
- 5 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
125
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
5
domains first source-reported within 30 days
First observed, 30 days
145
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF ~all · 1/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-20 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- gmailgoogleyoutube
- Label aliases
- Gmail · Google · YouTube
- Official domains
- abc.xyz · google.com · gmail.com · goo.gl · youtube.com (all)
- Generated spellings
- 400 tracked · 114 observed somewhere · 286 not observed (all)
- Can receive mail
- 43 spellings and 25 reported domains publish MX records · mail at Google 10 · Microsoft 365 5 · Above.com parking (parking placeholder) 4 · 40 more (114 spellings and 125 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
google[.]jl[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive38.95.75.43 · Confirmed phishing host address (DomainSpoof, 48 hours)NETLAB-SDN (AS979) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google[.]js[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive38.95.75.43 · Confirmed phishing host address (DomainSpoof, 48 hours)NETLAB-SDN (AS979) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google1107[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.6.7CloudflareCloudflare (AS13335) · US172.67.134.32CloudflareCloudflare (AS13335) · US2606:4700:3033::6815:607CloudflareCloudflare (AS13335) · US2606:4700:3033::ac43:8620CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google1208[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive43.169.53.101 · Confirmed phishing host address (DomainSpoof, 48 hours)ACE-AS-AP ACE (AS139341) · SGchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google1302[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.24.216CloudflareCloudflare (AS13335) · US172.67.220.216CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:18d8CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:dcd8CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google1308[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive43.169.53.101 · Confirmed phishing host address (DomainSpoof, 48 hours)ACE-AS-AP ACE (AS139341) · SGchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googleanalysis[.]topMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
googlebusiness[.]xyzMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.95.33CloudflareCloudflare (AS13335) · US172.67.142.164CloudflareCloudflare (AS13335) · US2606:4700:3031::6815:5f21CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:8ea4CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googleepkay[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.34.119CloudflareCloudflare (AS13335) · US172.67.204.197CloudflareCloudflare (AS13335) · US2606:4700:3032::6815:2277CloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:ccc5CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googleinterviewmeetingmeet[.]liveMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARC · checked 2026-10-19mail at googleinterviewmeetingmeet.live · DMARC policy none (monitor only) · sends via MailChannels | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.225.128.78 · Confirmed phishing host address (DomainSpoof, 48 hours)SHOCK-1 (AS395092) · USfl-s1.serverpanel.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googlelogos[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.7.86CloudflareCloudflare (AS13335) · US172.67.135.233CloudflareCloudflare (AS13335) · US2606:4700:3034::ac43:87e9CloudflareCloudflare (AS13335) · US2606:4700:3037::6815:756CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
tw[.]googlemarket[.]shopMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
googlemeet[.]inkMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours) · checked 2026-10-20mail at mx.googlemeet.ink | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive144.124.249.193 · Confirmed phishing host address (DomainSpoof, 48 hours)VDSINA (AS216071) · AEv558013.hosted-by-vdsina.comchecked 2026-10-20 06:10 UTC | 1 source · 1 record | Details |
googlemeeting[.]usMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPF · Confirmed phishing host address (DomainSpoof, 48 hours)DMARC · checked 2026-10-19mail at googlemeeting.us · DMARC policy none (monitor only) · sends via MailChannels | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.225.128.78 · Confirmed phishing host address (DomainSpoof, 48 hours)SHOCK-1 (AS395092) · USfl-s1.serverpanel.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
app[.]googleoa[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive119.28.83.45 · Confirmed phishing host address (DomainSpoof, 48 hours)Tencent CloudTencent Cloud (AS132203) · CNchecked 2026-10-20 05:10 UTC | 1 source · 1 record | Details |
googleplaiby[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.18.10.234CloudflareCloudflare (AS13335) · US104.18.11.234CloudflareCloudflare (AS13335) · US2606:4700::6812:aeaCloudflareCloudflare (AS13335) · US2606:4700::6812:beaCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googleplaypro[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive69.67.172.126 · Confirmed phishing host address (DomainSpoof, 48 hours)BLNWX (AS399629) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googleripple[.]comMail: MXSPFDMARC · checked 2026-10-19mail at mail.googleripple.com · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.16.121CloudflareCloudflare (AS13335) · US172.67.212.86CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:d456CloudflareCloudflare (AS13335) · US2606:4700:3037::6815:1079CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googlesqzcacviii[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive178.255.244.79 · Confirmed phishing host address (DomainSpoof, 48 hours)checked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googlewalletsextensions[.]comMail: No mail records · checked 2026-10-20 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive216.198.79.65Amazon Web ServicesAmazon Web Services (AS16509) · US64.29.17.65Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-20 06:10 UTC | 1 source · 1 record | Details |
guidance-google[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive58.64.137.69 · Confirmed phishing host address (DomainSpoof, 48 hours)HKBNESL-AS-AP HKBN Enterprise Solutions Limited (AS17444) · HKchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google-verify[.]highlatch[.]comMail: MXSPFDMARC · checked 2026-10-19mail at _dc-mx.9fa3e2a568ac.highlatch.com · DMARC policy none (monitor only) · sends via Hostinger | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
io-utmsource-google-campaign-5645542-keyword-opensaee[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive62.60.226.163 · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)FEMOIT (AS214351) · GBchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
io-utmsource-google-campaign-5645543-keyword-opensaee[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.33.175CloudflareCloudflare (AS13335) · US172.67.147.170CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:93aaCloudflareCloudflare (AS13335) · US2606:4700:3032::6815:21afCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
junpukai-google[.]comMail: Lookup failed · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive150.95.255.38 · Confirmed phishing host address (DomainSpoof, 48 hours)INTERQ GMO Internet Group, Inc. (AS7506) · JPchecked 2026-10-20 01:05 UTC | 1 source · 1 record | Details |
125 registrable domains · 127 hostnames · page 3 of 5← PreviousNext →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.