public company · US

Google

Alphabet Inc.

Search, Gmail and cloud services.

Primary official domain
google.com
Reviewed official domains
5 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
118
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
5
domains first source-reported within 30 days
First observed, 30 days
138
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
Not checked
No email-policy check yet

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
gmailgoogleyoutube
Label aliases
Gmail · Google · YouTube
Official domains
abc.xyz · google.com · gmail.com · goo.gl · youtube.com (all)
Generated spellings
378 tracked · 160 observed somewhere · 218 not observed (all)

Certificate domains matching this brand

Names identified in certificate logs that match this company or brand. A brand match does not indicate bad intent or malicious activity.

Matching domain groups, 30 days
788
distinct registrable domains with a matching certificate name, by latest CT log time; not attacks
Reviewed official
0
groups on this organization's reviewed official domains, 30 days
Not assessed
788
groups with the brand in the name and no review; no judgement implied
Latest CT observation
2026-10-19 07:20 UTC
log timestamp, not issuance or collection time
Matching domain / nameMatched brand / domainMatch typeFirst CT observationLatest CT observationDistinct certificatesRelationshipSource-reported abuseDetails
ekfotongmail.direct.quickconnect.to1 name · includes wildcard names
gmailBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC3Not assessedNo report in sample coverage
ekfotongmail.direct.quickconnect.to
gmailBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC3Issuer YR1
*.ekfotongmail.direct.quickconnect.toWildcard certificate name: a pattern, not an observed live host
gmailBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC3Issuer YR1
zanorbridge.biz.id1 name
googleBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC2Not assessedNo report in sample coverage
google.zanorbridge.biz.id
googleBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC2Issuer YE1
glifeplay.com1 name
googleBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC1Not assessedNo report in sample coverage
google.glifeplay.com
googleBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC1Issuer WR1
youtubeinchina.workers.dev2 names · includes wildcard names
youtubeBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC1Not assessedNo report in sample coverage
*.proxxxxxy.youtubeinchina.workers.devWildcard certificate name: a pattern, not an observed live host
youtubeBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC1Issuer WR1
youtubeinchina.workers.dev
youtubeBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC1Issuer WR1
chokasiexpress.de1 name
googleBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC2Not assessedNo report in sample coverage
google.chokasiexpress.de
googleBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC2Issuer YE2
youtube-caption-app.pages.dev1 name · includes wildcard names
youtubeBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC2Not assessedNo report in sample coverage
youtube-caption-app.pages.dev
youtubeBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC2Issuer YE2
*.youtube-caption-app.pages.devWildcard certificate name: a pattern, not an observed live host
youtubeBrand token in name2026-10-19 07:20 UTC2026-10-19 07:20 UTC2Issuer YE2
rrtyntaxbtr.dpdns.org1 name
googleBrand token in name2026-10-19 03:56 UTC2026-10-19 07:19 UTC70Not assessedNo report in sample coverage
chatgpt.arpa.q1.wikipedia.org.🫴.www.cdn.speedtest.net.h.google.ru.zula.ir.1.1.1.🖐🏻🤚🏻✋🏾🖖🏾🫳🏼🤏🏼🤏🏼🤌🏻.tls.🙋🏻🙋🏻🙋🏻🙋🏻🙋🏻🙋🏻.🙋🏻🙋🏻🙋🏻🙋🏻🙋🏻🙋🏻.fake.🩁🧵🧶🌂💍👑⛑🎓.aparat.com.zula.ir.rrtyntaxbtr.dpdns.orgchatgpt.arpa.q1.wikipedia.org.xn--m39h.www.cdn.speedtest.net.h.google.ru.zula.ir.1.1.1.xn--6bi8548mabeaana921b9b830dbbb0nn92a.tls.xn--mn8haaaaa252bbabbbb.xn--mn8haaaaa252bbabbbb.fake.xn--j9h1028mqmaoytii00aha21d.aparat.com.zula.ir.rrtyntaxbtr.dpdns.org
googleBrand token in name2026-10-19 03:56 UTC2026-10-19 07:19 UTC70Issuer WR1
googlechrome881568.com7 names · includes wildcard names
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:19 UTC6Not assessedNo report in sample coverage
a.googlechrome881568.com
googleBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Issuer YR1
b.googlechrome881568.com
googleBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Issuer YR1
c.googlechrome881568.com
googleBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Issuer YR1
aa.googlechrome881568.com
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC2Issuer YR2
bb.googlechrome881568.com
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC2Issuer YR2
2 more names in this group (most recent shown)
noorasim.ir1 name
gmailBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC1Not assessedNo report in sample coverage
www.www.test.gmail.noorasim.ir
gmailBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC1Issuer YE2
almas.it1 name
googleBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Not assessedNo report in sample coverage
l.google.com.almas.it
googleBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Issuer YE2
sssyoutube.net1 name · includes wildcard names
youtubeBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Not assessedNo report in sample coverage
sssyoutube.net
youtubeBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Issuer YE2
*.sssyoutube.netWildcard certificate name: a pattern, not an observed live host
youtubeBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC2Issuer YE2
1844002667.workers.dev1 name · wildcard names only
youtubeBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC1Not assessedNo report in sample coverage
*.youtube.1844002667.workers.devWildcard certificate name: a pattern, not an observed live host
youtubeBrand token in name2026-10-19 07:19 UTC2026-10-19 07:19 UTC1Issuer WR1
cloudindex-google-jy9.pages.dev1 name · includes wildcard names
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC1Not assessedNo report in sample coverage
cloudindex-google-jy9.pages.dev
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC1Issuer YE2
*.cloudindex-google-jy9.pages.devWildcard certificate name: a pattern, not an observed live host
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC1Issuer YE2
google-home-zipy-zipzy-89.net.ph1 name
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC2Not assessedNo report in sample coverage
www.google-home-zipy-zipzy-89.net.ph
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC2Issuer YE2
zanorpulse.my.id1 name
googleBrand token in name2026-10-19 05:28 UTC2026-10-19 07:18 UTC3Not assessedNo report in sample coverage
google.zanorpulse.my.id
googleBrand token in name2026-10-19 05:28 UTC2026-10-19 07:18 UTC3Issuer YE2
zanorengine.my.id1 name
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC2Not assessedNo report in sample coverage
google.zanorengine.my.id
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC2Issuer YE1
2178523692.workers.dev1 name · wildcard names only
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC1Not assessedNo report in sample coverage
*.google.2178523692.workers.devWildcard certificate name: a pattern, not an observed live host
googleBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC1Issuer WR1
gunarslvgmailv.direct.quickconnect.to1 name · includes wildcard names
gmailBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC4Not assessedNo report in sample coverage
gunarslvgmailv.direct.quickconnect.to
gmailBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC4Issuer YR1
*.gunarslvgmailv.direct.quickconnect.toWildcard certificate name: a pattern, not an observed live host
gmailBrand token in name2026-10-19 07:18 UTC2026-10-19 07:18 UTC4Issuer YR1
qarvofactory.de1 name
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC2Not assessedNo report in sample coverage
google.qarvofactory.de
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC2Issuer YE2
c51849420gmail.direct.quickconnect.to1 name · includes wildcard names
gmailBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC4Not assessedNo report in sample coverage
c51849420gmail.direct.quickconnect.to
gmailBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC4Issuer YR2
*.c51849420gmail.direct.quickconnect.toWildcard certificate name: a pattern, not an observed live host
gmailBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC4Issuer YR2
googleusercontent.workers.dev2 names · includes wildcard names
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC1Not assessedNo report in sample coverage
*.flat-dream-9abb-hindi-1.googleusercontent.workers.devWildcard certificate name: a pattern, not an observed live host
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC1Issuer WR1
googleusercontent.workers.dev
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC1Issuer WR1
us-central1-runtime-connectors-google.com1 name · wildcard names only
googleBrand token in name2026-10-19 01:32 UTC2026-10-19 07:17 UTC24Not assessedNo report in sample coverage
*.us-central1-runtime-connectors-google.comWildcard certificate name: a pattern, not an observed live host
googleBrand token in name2026-10-19 01:32 UTC2026-10-19 07:17 UTC24Issuer WR3
googlemeetus3.pages.dev1 name · includes wildcard names
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC1Not assessedNo report in sample coverage
googlemeetus3.pages.dev
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC1Issuer WE1
*.googlemeetus3.pages.devWildcard certificate name: a pattern, not an observed live host
googleBrand token in name2026-10-19 07:17 UTC2026-10-19 07:17 UTC1Issuer WE1
rolandblokgmail.direct.quickconnect.to1 name · includes wildcard names
gmailBrand token in name2026-10-19 07:16 UTC2026-10-19 07:17 UTC4Not assessedNo report in sample coverage
rolandblokgmail.direct.quickconnect.to
gmailBrand token in name2026-10-19 07:16 UTC2026-10-19 07:17 UTC4Issuer YR1
*.rolandblokgmail.direct.quickconnect.toWildcard certificate name: a pattern, not an observed live host
gmailBrand token in name2026-10-19 07:16 UTC2026-10-19 07:17 UTC4Issuer YR1
funmaker.jp1 name
googleBrand token in name2026-10-19 07:16 UTC2026-10-19 07:16 UTC2Not assessedNo report in sample coverage
googleapi.funmaker.jp
googleBrand token in name2026-10-19 07:16 UTC2026-10-19 07:16 UTC2Issuer YR1

Collected from public certificate-transparency logs since 2026-10-18; 30,973,086 log entries checked so far. 80 logs are read continuously by our CT resolver from the point it started following them; earlier entries are not covered. Names on an organization's official domains are recorded by the resolver for at most 100 names per registrable domain per day, so official-domain name and certificate counts are lower bounds. Times are CT log timestamps, which differ from certificate validity dates. Certificate counts include precertificates and final certificates as separate artifacts. The "Source-reported abuse" badge appears only when an independent source reported that exact name for this organization; a certificate name match never creates it, and "No report in sample coverage" is not a safety verdict. How CT works