public company · US
Alphabet Inc.
Search, Gmail and cloud services.
- Primary official domain
- google.com
- Reviewed official domains
- 5 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
125
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
5
domains first source-reported within 30 days
First observed, 30 days
145
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF ~all · 1/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-20 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- gmailgoogleyoutube
- Label aliases
- Gmail · Google · YouTube
- Official domains
- abc.xyz · google.com · gmail.com · goo.gl · youtube.com (all)
- Generated spellings
- 400 tracked · 114 observed somewhere · 286 not observed (all)
- Can receive mail
- 43 spellings and 25 reported domains publish MX records · mail at Google 10 · Microsoft 365 5 · Above.com parking (parking placeholder) 4 · 40 more (114 spellings and 125 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
| Uncommon brand names and source labels | ||||||
gmail-support[.]netlify[.]appMail: SPFDMARC · checked 2026-10-19DMARC policy reject | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-10-15Source reported | Alive18.208.88.157Amazon Web ServicesAmazon Web Services (AS14618) · USec2-18-208-88-157.compute-1.amazonaws.com98.84.224.111Amazon Web ServicesAmazon Web Services (AS14618) · USec2-98-84-224-111.compute-1.amazonaws.com2600:1f18:16e:df01::258Amazon Web ServicesAmazon Web Services (AS14618) · US2600:1f18:16e:df01::259Amazon Web ServicesAmazon Web Services (AS14618) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google[.]documentsharing[.]frMail: No mail records · checked 2026-10-19 | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-10-14Source reported | Alive45.74.61.8 · Confirmed phishing host address (DomainSpoof, 48 hours), Emerging Threats open block list, Spamhaus DROP (credit: The Spamhaus Project)AS-69HOST (AS205397) · USchecked 2026-10-20 05:00 UTC | 1 source · 2 records | Details |
googleworkspace[.]gestioncompte[.]comMail: No mail records · checked 2026-10-19 | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-10-09Source reported | Alive185.53.179.136Parking page · ParkingCrew (Team Internet)ParkingCrew (Team Internet) (AS206834) · DEchecked 2026-10-20 05:00 UTC | 1 source · 2 records | Details |
google[.]documentspartage[.]comMail: No mail records · checked 2026-10-19 | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-09-29Source reported | Alive141.11.185.74 · Confirmed phishing host address (DomainSpoof, 48 hours)OUIHEBERG (AS208226) · FR141-11-185-74.rev.network-ouiheberg.euchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
google[.]documentpartage[.]comMail: No mail records · checked 2026-10-19 | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-09-24Source reported | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
| Very common brand names | ||||||
bugfix-sbb-8868-google-pay-express-empty-shipping-address[.]snappy-shopper-snappy-v1[.]snappygroupdev[.]co[.]ukMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive13.41.46.35Amazon Web ServicesAmazon Web Services (AS16509) · USec2-13-41-46-35.eu-west-2.compute.amazonaws.comchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
support-google[.]plMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPFDMARC · checked 2026-10-19mail at support-google.pl · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive85.128.244.69 · Confirmed phishing host address (DomainSpoof, 48 hours)NETARTGROUP (AS15967) · PLshared-aoi69.rev.nazwa.plchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
updates-google[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 48 hours)SPFDMARC · checked 2026-10-19mail at mail.updates-google.com · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive64.181.217.59 · Confirmed phishing host address (DomainSpoof, 48 hours)Oracle CloudOracle Cloud (AS31898) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
vault-google[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.19.118CloudflareCloudflare (AS13335) · US172.67.186.35CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:ba23CloudflareCloudflare (AS13335) · US2606:4700:3033::6815:1376CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
verifydevice-google[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.93.196CloudflareCloudflare (AS13335) · US172.67.214.50CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:5dc4CloudflareCloudflare (AS13335) · US2606:4700:3037::ac43:d632CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
webmeet-google[.]coMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive216.126.239.76 · Confirmed phishing host address (DomainSpoof, 48 hours)ROUTERHOSTING (AS14956) · US76.239.126.216.static.cloudzy.comchecked 2026-10-20 05:05 UTC | 1 source · 1 record | Details |
webmeet-google[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | NXDOMAINchecked 2026-10-20 04:55 UTC | 1 source · 1 record | Details |
www-google[.]clickMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.38.193CloudflareCloudflare (AS13335) · US172.67.137.239CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:89efCloudflareCloudflare (AS13335) · US2606:4700:3034::6815:26c1CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
www-google[.]cnMail: No mail records · checked 2026-10-20 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive8.212.18.107 · Confirmed phishing host address (DomainSpoof, 48 hours)Alibaba CloudAlibaba Cloud (AS45102) · CNchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
www-hk-google[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.12.194CloudflareCloudflare (AS13335) · US172.67.153.55CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:9937CloudflareCloudflare (AS13335) · US2606:4700:3034::6815:cc2CloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
accounts[.]google[.]login[.]secure[.]id[.]google[.]com[.]zkey0[.]comMail: MX · checked 2026-10-19mail at Google (consumer mailbox) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-20Observed in feed | Alive104.21.23.171CloudflareCloudflare (AS13335) · US172.67.212.92CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:d45cCloudflareCloudflare (AS13335) · US2606:4700:3036::6815:17abCloudflareCloudflare (AS13335) · USchecked 2026-10-20 05:10 UTC | 1 source · 1 record | Details |
google[.]com[.]pyMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy reject | Reported by PhishTankAbsent from latest snapshot | Possible associationBrand in hostname | 2026-10-14Source reported | Alive172.253.63.94GoogleGoogle (AS15169) · USbi-in-f94.1e100.net2607:f8b0:4004:c08::5eGoogleGoogle (AS15169) · USbi-in-f94.1e100.netchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
googlee-playstors[.]vercel[.]appMail: SPFDMARC · checked 2026-10-19DMARC policy reject | Reported by PhishTankPresent in latest snapshot | Possible associationBrand in hostname | 2026-09-22Source reported | Alive216.198.79.195Amazon Web ServicesAmazon Web Services (AS16509) · US64.29.17.195Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-20 05:00 UTC | 1 source · 1 record | Details |
| 5 names with the very common brand name 'youtube' (shown on request) | ||||||
| 2 names with the very common brand name 'gmail' (shown on request) | ||||||
125 registrable domains · 127 hostnames · page 5 of 5← Previous
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.