public company · US

The Coca-Cola Company

COCA COLA CO

Primary official domain
coca-colacompany.com
Reviewed official domains
1 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
4
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
4
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
Not checked
No email-policy check yet

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
cocacola
Label aliases
The Coca-Cola Company
Official domains
coca-colacompany.com (all)
Generated spellings
299 tracked · 32 observed somewhere · 267 not observed (all)
Can receive mail
15 spellings and 0 reported domains publish MX records · mail at ns1.ko.com 2 · ns3-old.ko.com 2 · ALL-INKL 1 · 10 more (32 spellings and 4 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)

Generated spellings we track

Spellings generated from this organization's official domains and brand tokens (typos, keyboard slips, lure words, look-alike characters, other top-level domains). Each one is checked against phishing feeds, certificate logs and DNS. A spelling that exists is not a finding and not a verdict: it may be unrelated, legitimate or registered defensively.

Tracked spellings
299
generated 2026-10-19; bounded dictionary, not every possible spelling
Seen in a phishing feed
0
spellings with at least one approved-source feed host on that domain
Seen in certificate logs
0
spellings with a certificate name on that domain in the logs we collect
Resolves
32
spellings that answered a DNS query; 299 of 299 checked so far
Can receive mail
15
spellings with an MX record, of 32 checked · mail at ns1.ko.com 2 · ns3-old.ko.com 2 · ALL-INKL 1 · show
Listed mail infrastructure
0
mail-enabled spellings whose MX host address or SPF sending range is on an IP list approved for display · a fact about shared addresses, not about who operates the spelling

Lure word added 1 tracked · 1 observed

SpellingDerived fromIn phishing feedIn certificate logsResolvesMailState
cocacolasupport[.]com
cocacolaNot observedNot observed
Alive172.67.145.1CloudflareCloudflare (AS13335) · US104.21.95.137CloudflareCloudflare (AS13335) · USlast answered 2026-10-19
MXSPFDMARCmail at Google (consumer mailbox) · DMARC policy quarantine · sends via Google, SendGrid · checked 2026-10-19
Observed

Other top-level domain 5 tracked · 5 observed

SpellingDerived fromIn phishing feedIn certificate logsResolvesMailState
cocacola[.]site
cocacolaNot observedNot observed
Alive81.88.48.71 · Confirmed phishing host address (DomainSpoof, 14 days)REGISTER-AS (AS39729) · IThostingnom.webapps.netlast answered 2026-10-19
MXSPFDMARCmail at mail.nominalia.com · sends via spf.webapps.net · checked 2026-10-19
Observed
cocacola[.]net
cocacolaNot observedNot observed
Alive208.134.241.178CENTURYLINK-LEGACY-SAVVIS (AS3561) · USlast answered 2026-10-19
MXSPFDMARCmail at ns1.ko.com · checked 2026-10-19
Observed
cocacola[.]io
cocacolaNot observedNot observed
Alive129.33.59.52KYN-GTS (AS14904) · USlast answered 2026-10-19
MXSPFDMARCmail at ns3-old.ko.com · checked 2026-10-19
Observed
cocacola[.]cc
cocacolaNot observedNot observed
Alive208.134.241.178CENTURYLINK-LEGACY-SAVVIS (AS3561) · USlast answered 2026-10-19
MXSPFDMARCmail at ns1.ko.com · checked 2026-10-19
Observed
cocacola[.]app
cocacolaNot observedNot observed
Alive217.160.0.165 · Confirmed phishing host address (DomainSpoof, 14 days)IONOSIONOS (AS8560) · DE217-160-0-165.elastic-ssl.ui-r.comlast answered 2026-10-19
MXSPFDMARCmail at mx01.ionos.es · DMARC policy none (monitor only) · sends via IONOS · checked 2026-10-19
Observed

Look-alike characters (ASCII) 1 tracked · 1 observed

SpellingDerived fromIn phishing feedIn certificate logsResolvesMailState
cocacoia[.]com
cocacolaNot observedNot observed
Alive217.160.0.34IONOSIONOS (AS8560) · DE217-160-0-34.elastic-ssl.ui-r.comlast answered 2026-10-19
MXSPFDMARCmail at mx00.ionos.es · DMARC policy none (monitor only) · sends via IONOS · checked 2026-10-19
Observed

Character omitted 3 tracked · 3 observed

SpellingDerived fromIn phishing feedIn certificate logsResolvesMailState
cocacoa[.]com
cocacolaNot observedNot observed
Alive62.149.189.55 · Confirmed phishing host address (DomainSpoof, 14 days)ARUBA-ASN (AS31034) · IThost55-189-149-62.serverdedicati.aruba.itlast answered 2026-10-19
MXSPFDMARCmail at mx.cocacoa.com · checked 2026-10-19
Observed
cocaola[.]com
cocacolaNot observedNot observed
Alive89.248.106.140CLOUDBUILDERS (AS48348) · ESlh028.interdominios.comlast answered 2026-10-19
MXSPFDMARCmail at mail.cocaola.com · checked 2026-10-19
Observed
cocacolacompany[.]com
coca-colacompany.comNot observedNot observed
Alive52.14.144.171Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-14-144-171.us-east-2.compute.amazonaws.comlast answered 2026-10-19
MXSPFDMARCmail at ns3-old.ko.com · checked 2026-10-19
Observed

Character repeated 1 tracked · 1 observed

SpellingDerived fromIn phishing feedIn certificate logsResolvesMailState
cocacolla[.]com
cocacolaNot observedNot observed
Alive172.239.53.98Akamai LinodeAkamai Linode (AS63949) · SG172-239-53-98.ip.linodeusercontent.com172.238.172.132Akamai LinodeAkamai Linode (AS63949) · SG172-238-172-132.ip.linodeusercontent.com172.232.6.52Akamai LinodeAkamai Linode (AS63949) · SG172-232-6-52.ip.linodeusercontent.comlast answered 2026-10-19
MXSPFDMARCmail at hostedmxserver.com (web / mail hosting) · checked 2026-10-19
Observed

Adjacent key typo 4 tracked · 4 observed

SpellingDerived fromIn phishing feedIn certificate logsResolvesMailState
vocacola[.]com
cocacolaNot observedNot observed
Alive207.207.210.23Amazon Web ServicesAmazon Web Services (AS16509) · US207.207.210.36Amazon Web ServicesAmazon Web Services (AS16509) · US207.207.210.50Amazon Web ServicesAmazon Web Services (AS16509) · USlast answered 2026-10-19
MXSPFDMARCmail at Porkbun (web / mail hosting) · sends via Porkbun · checked 2026-10-19
Observed
docacola[.]com
cocacolaNot observedNot observed
Alive85.13.154.98NMM-AS D - 02742 Friedersdorf Hauptstrasse 68 (AS34788) · DEdd37812.kasserver.comlast answered 2026-10-19
MXSPFDMARCmail at ALL-INKL (web / mail hosting) · sends via ALL-INKL · checked 2026-10-19
Observed
codacola[.]com
cocacolaNot observedNot observed
Alive104.247.81.99TEAMINTERNET-CA-AS (AS206834) · DElast answered 2026-10-19
MXSPFDMARCmail at h-email.net (parking placeholder) · checked 2026-10-19
Observed
cocafola[.]com
cocacolaNot observedNot observed
Alive37.9.175.211 · Confirmed phishing host address (DomainSpoof, 14 days)WEBSUPPORT-SRO-SK-AS (AS51013) · SKing.r4.websupport.czlast answered 2026-10-19
MXSPFDMARCmail at mx20.active24.cz · DMARC policy quarantine · sends via _spf.websupport.cz · checked 2026-10-19
Observed

Last feed and certificate-log check 2026-10-19 05:45 UTC. “Not observed” means none of our checks has seen the spelling; it is not proof the name is unregistered. An observed spelling is not a finding: reported abuse appears only under Reported matches, from independent source evidence. Feed presence counts hosts from approved sources only; certificate presence comes from the public logs described on the Certificates tab; DNS checks cover the apex name and are refreshed on a schedule. Under each address: network (AS) and country come from the public iptoasn.com routing dataset; a reverse-DNS name is what the address's owner published. Neither shows who controls the hostname: shared hosting, CDNs and cloud providers put unrelated names behind one address. Mail (MX, SPF, DMARC) is checked only for spellings observed somewhere; mail records show the domain can send or receive mail; they do not show who operates it. The provider named under the chips is read from the first MX host (a curated list of mailbox, hosting, parking, forwarding and registrar services; otherwise the host itself); “sends via” lists the services the SPF record authorises; the DMARC policy is the published p= tag. A red MX or SPF chip names the IP list an address behind the record is on (the MX host's address, or an SPF ip4 range of the record or of the services it includes), checked at page view against the lists approved for display. Mail providers and sending services are shared, so a listing says nothing about who operates the domain. The last bulk DNS check of every tracked spelling finished 2026-10-19 11:34 UTC (784,714 names).