public company · US
Alphabet Inc.
Search, Gmail and cloud services.
- Primary official domain
- google.com
- Reviewed official domains
- 5 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
125
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
5
domains first source-reported within 30 days
First observed, 30 days
145
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF ~all · 1/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-20 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- gmailgoogleyoutube
- Label aliases
- Gmail · Google · YouTube
- Official domains
- abc.xyz · google.com · gmail.com · goo.gl · youtube.com (all)
- Generated spellings
- 400 tracked · 114 observed somewhere · 286 not observed (all)
- Can receive mail
- 43 spellings and 25 reported domains publish MX records · mail at Google 10 · Microsoft 365 5 · Above.com parking (parking placeholder) 4 · 40 more (114 spellings and 125 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
gmail-account-recovery[.]microtool[.]devMail: MXSPF · checked 2026-10-19mail at Cloudflare Email Routing (mail forwarding) · sends via Cloudflare Email Routing | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.0.172CloudflareCloudflare (AS13335) · US172.67.128.36CloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:8024CloudflareCloudflare (AS13335) · US2606:4700:3037::6815:acCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
proservicealademande971-gmail[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Webador (web / mail hosting) · DMARC policy none (monitor only) · sends via Webador | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive35.204.150.5Google CloudGoogle Cloud (AS396982) · US5.150.204.35.bc.googleusercontent.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
safe-gmail[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive58.64.137.69 · Confirmed phishing host address (DomainSpoof, 48 hours)HKBNESL-AS-AP HKBN Enterprise Solutions Limited (AS17444) · HKchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
| 21 names with the very common brand name 'google' (shown on request) | ||||||
| 1 name with the very common brand name 'youtube' (shown on request) | ||||||
125 registrable domains · 127 hostnames · page 4 of 5← PreviousNext →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.