public company · US
The Coca-Cola Company
COCA COLA CO
- Primary official domain
- coca-colacompany.com
- Reviewed official domains
- 1 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- cocacola
- Label aliases
- The Coca-Cola Company
- Official domains
- coca-colacompany.com (all)
- Generated spellings
- 299 tracked · 32 observed somewhere · 267 not observed (all)
- Can receive mail
- 15 spellings and 0 reported domains publish MX records · mail at ns1.ko.com 2 · ns3-old.ko.com 2 · ALL-INKL 1 · 10 more (32 spellings and 4 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Generated spellings we track
Spellings generated from this organization's official domains and brand tokens (typos, keyboard slips, lure words, look-alike characters, other top-level domains). Each one is checked against phishing feeds, certificate logs and DNS. A spelling that exists is not a finding and not a verdict: it may be unrelated, legitimate or registered defensively.
Lure word added 1 tracked · 1 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
cocacolasupport[.]com | cocacola | Not observed | Not observed | Alive172.67.145.1CloudflareCloudflare (AS13335) · US104.21.95.137CloudflareCloudflare (AS13335) · USlast answered 2026-10-19 | MXSPFDMARCmail at Google (consumer mailbox) · DMARC policy quarantine · sends via Google, SendGrid · checked 2026-10-19 | Observed |
Other top-level domain 5 tracked · 5 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
cocacola[.]site | cocacola | Not observed | Not observed | Alive81.88.48.71 · Confirmed phishing host address (DomainSpoof, 14 days)REGISTER-AS (AS39729) · IThostingnom.webapps.netlast answered 2026-10-19 | MXSPFDMARCmail at mail.nominalia.com · sends via spf.webapps.net · checked 2026-10-19 | Observed |
cocacola[.]net | cocacola | Not observed | Not observed | Alive208.134.241.178CENTURYLINK-LEGACY-SAVVIS (AS3561) · USlast answered 2026-10-19 | MXSPFDMARCmail at ns1.ko.com · checked 2026-10-19 | Observed |
cocacola[.]io | cocacola | Not observed | Not observed | Alive129.33.59.52KYN-GTS (AS14904) · USlast answered 2026-10-19 | MXSPFDMARCmail at ns3-old.ko.com · checked 2026-10-19 | Observed |
cocacola[.]cc | cocacola | Not observed | Not observed | Alive208.134.241.178CENTURYLINK-LEGACY-SAVVIS (AS3561) · USlast answered 2026-10-19 | MXSPFDMARCmail at ns1.ko.com · checked 2026-10-19 | Observed |
cocacola[.]app | cocacola | Not observed | Not observed | Alive217.160.0.165 · Confirmed phishing host address (DomainSpoof, 14 days)IONOSIONOS (AS8560) · DE217-160-0-165.elastic-ssl.ui-r.comlast answered 2026-10-19 | MXSPFDMARCmail at mx01.ionos.es · DMARC policy none (monitor only) · sends via IONOS · checked 2026-10-19 | Observed |
Look-alike characters (ASCII) 1 tracked · 1 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
cocacoia[.]com | cocacola | Not observed | Not observed | Alive217.160.0.34IONOSIONOS (AS8560) · DE217-160-0-34.elastic-ssl.ui-r.comlast answered 2026-10-19 | MXSPFDMARCmail at mx00.ionos.es · DMARC policy none (monitor only) · sends via IONOS · checked 2026-10-19 | Observed |
Character omitted 3 tracked · 3 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
cocacoa[.]com | cocacola | Not observed | Not observed | Alive62.149.189.55 · Confirmed phishing host address (DomainSpoof, 14 days)ARUBA-ASN (AS31034) · IThost55-189-149-62.serverdedicati.aruba.itlast answered 2026-10-19 | MXSPFDMARCmail at mx.cocacoa.com · checked 2026-10-19 | Observed |
cocaola[.]com | cocacola | Not observed | Not observed | Alive89.248.106.140CLOUDBUILDERS (AS48348) · ESlh028.interdominios.comlast answered 2026-10-19 | MXSPFDMARCmail at mail.cocaola.com · checked 2026-10-19 | Observed |
cocacolacompany[.]com | coca-colacompany.com | Not observed | Not observed | Alive52.14.144.171Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-14-144-171.us-east-2.compute.amazonaws.comlast answered 2026-10-19 | MXSPFDMARCmail at ns3-old.ko.com · checked 2026-10-19 | Observed |
Character repeated 1 tracked · 1 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
cocacolla[.]com | cocacola | Not observed | Not observed | Alive172.239.53.98Akamai LinodeAkamai Linode (AS63949) · SG172-239-53-98.ip.linodeusercontent.com172.238.172.132Akamai LinodeAkamai Linode (AS63949) · SG172-238-172-132.ip.linodeusercontent.com172.232.6.52Akamai LinodeAkamai Linode (AS63949) · SG172-232-6-52.ip.linodeusercontent.comlast answered 2026-10-19 | MXSPFDMARCmail at hostedmxserver.com (web / mail hosting) · checked 2026-10-19 | Observed |
Adjacent key typo 4 tracked · 4 observed
| Spelling | Derived from | In phishing feed | In certificate logs | Resolves | State | |
|---|---|---|---|---|---|---|
vocacola[.]com | cocacola | Not observed | Not observed | Alive207.207.210.23Amazon Web ServicesAmazon Web Services (AS16509) · US207.207.210.36Amazon Web ServicesAmazon Web Services (AS16509) · US207.207.210.50Amazon Web ServicesAmazon Web Services (AS16509) · USlast answered 2026-10-19 | MXSPFDMARCmail at Porkbun (web / mail hosting) · sends via Porkbun · checked 2026-10-19 | Observed |
docacola[.]com | cocacola | Not observed | Not observed | Alive85.13.154.98NMM-AS D - 02742 Friedersdorf Hauptstrasse 68 (AS34788) · DEdd37812.kasserver.comlast answered 2026-10-19 | MXSPFDMARCmail at ALL-INKL (web / mail hosting) · sends via ALL-INKL · checked 2026-10-19 | Observed |
codacola[.]com | cocacola | Not observed | Not observed | Alive104.247.81.99TEAMINTERNET-CA-AS (AS206834) · DElast answered 2026-10-19 | MXSPFDMARCmail at h-email.net (parking placeholder) · checked 2026-10-19 | Observed |
cocafola[.]com | cocacola | Not observed | Not observed | Alive37.9.175.211 · Confirmed phishing host address (DomainSpoof, 14 days)WEBSUPPORT-SRO-SK-AS (AS51013) · SKing.r4.websupport.czlast answered 2026-10-19 | MXSPFDMARCmail at mx20.active24.cz · DMARC policy quarantine · sends via _spf.websupport.cz · checked 2026-10-19 | Observed |
Last feed and certificate-log check 2026-10-19 05:45 UTC. “Not observed” means none of our checks has seen the spelling; it is not proof the name is unregistered. An observed spelling is not a finding: reported abuse appears only under Reported matches, from independent source evidence. Feed presence counts hosts from approved sources only; certificate presence comes from the public logs described on the Certificates tab; DNS checks cover the apex name and are refreshed on a schedule. Under each address: network (AS) and country come from the public iptoasn.com routing dataset; a reverse-DNS name is what the address's owner published. Neither shows who controls the hostname: shared hosting, CDNs and cloud providers put unrelated names behind one address. Mail (MX, SPF, DMARC) is checked only for spellings observed somewhere; mail records show the domain can send or receive mail; they do not show who operates it. The provider named under the chips is read from the first MX host (a curated list of mailbox, hosting, parking, forwarding and registrar services; otherwise the host itself); “sends via” lists the services the SPF record authorises; the DMARC policy is the published p= tag. A red MX or SPF chip names the IP list an address behind the record is on (the MX host's address, or an SPF ip4 range of the record or of the services it includes), checked at page view against the lists approved for display. Mail providers and sending services are shared, so a listing says nothing about who operates the domain. The last bulk DNS check of every tracked spelling finished 2026-10-19 11:34 UTC (784,714 names).

