public company · US
Microsoft
MICROSOFT CORP
Software, cloud and productivity services; among the most frequently impersonated brands in phishing reports.
- Primary official domain
- microsoft.com
- Reviewed official domains
- 10 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
111
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
137
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 7/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- hotmaillinkedinmicrosoftoffice365onedriveoutlooksharepoint
- Label aliases
- Hotmail · LinkedIn · Microsoft · Office 365 · OneDrive · Outlook · SharePoint
- Official domains
- microsoft.com · hotmail.com · licdn.com · linkedin.com · live.com · lnkd.in · microsoftonline.com · office.com · +2 more (all)
- Generated spellings
- 400 tracked · 168 observed somewhere · 232 not observed (all)
- Can receive mail
- 55 spellings and 49 reported domains publish MX records · mail at GoDaddy 8 · Google 8 · Microsoft 365 7 · 62 more (168 spellings and 111 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
authenticateonmicrosoft[.]comMail: MXSPF · checked 2026-10-19mail at mx.tu-media.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.54.23CloudflareCloudflare (AS13335) · US172.67.222.223CloudflareCloudflare (AS13335) · US2606:4700:3031::ac43:dedfCloudflareCloudflare (AS13335) · US2606:4700:3034::6815:3617CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:50 UTC | 1 source · 1 record | Details |
microsoft[.]authorised-support[.]com2 hostnames under authorised-support.comMail: MXSPFDMARC · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · DMARC policy reject · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive52.85.193.120Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-120.iad55.r.cloudfront.net52.85.193.34Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-34.iad55.r.cloudfront.net52.85.193.86Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-86.iad55.r.cloudfront.net52.85.193.95Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-95.iad55.r.cloudfront.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoftquarantine[.]authorised-support[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive52.85.193.120Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-120.iad55.r.cloudfront.net52.85.193.34Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-34.iad55.r.cloudfront.net52.85.193.86Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-86.iad55.r.cloudfront.net52.85.193.95Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-95.iad55.r.cloudfront.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft[.]comunicazioni-sicure[.]itMail: MXSPFDMARC · checked 2026-10-19mail at pmail.comunicazioni-sicure.it · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive34.240.138.155Amazon Web ServicesAmazon Web Services (AS16509) · USec2-34-240-138-155.eu-west-1.compute.amazonaws.com52.48.92.206Amazon Web ServicesAmazon Web Services (AS16509) · USec2-52-48-92-206.eu-west-1.compute.amazonaws.com54.77.191.63Amazon Web ServicesAmazon Web Services (AS16509) · USec2-54-77-191-63.eu-west-1.compute.amazonaws.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft[.]empowerbydxc[.]comMail: MX · checked 2026-10-19mail at GoDaddy (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.118.112.246Microsoft AzureMicrosoft Azure (AS8075) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft[.]update[.]eutelnet[.]infoMail: MXSPF · checked 2026-10-19mail at mail.eutelnet.info · sends via Mailchimp (Mandrill) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoftweb365[.]fwh[.]isMail: MXSPF · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive199.59.243.225Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmailmart[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at hotmailmart.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.246.188.8 · Confirmed phishing host address (DomainSpoof, 14 days)FLOKINET (AS200651) · ISnl2.flokinet.ischecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
outlook-email-2026[.]hstn[.]meMail: MXSPF · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft365xx1[.]iceiy[.]com2 hostnames under iceiy.comMail: MXSPF · checked 2026-10-19mail at mx.iceiy.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
outlook365verificationmethod[.]iceiy[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-19 13:30 UTC | 1 source · 1 record | Details |
invreceiptslinkedin[.]comMail: MXSPF · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.51.13CloudflareCloudflare (AS13335) · US172.67.216.99CloudflareCloudflare (AS13335) · US2606:4700:3032::ac43:d863CloudflareCloudflare (AS13335) · US2606:4700:3033::6815:330dCloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
sharepointonedriveaaqkada0yja1yji5l[.]jamejampaintingservice[.]com[.]auMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at mail.jamejampaintingservice.com.au · DMARC policy none (monitor only) · sends via HostGator | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive192.185.84.51 · Confirmed phishing host address (DomainSpoof, 14 days)Oracle CloudOracle Cloud (AS31898) · US192-185-84-51.unifiedlayer.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
onedrivedoccloud[.]kesug[.]comMail: MXSPF · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-5vwfq9rf-ns1oada3v-----hzlj11wwvw[.]kharwadejewellers[.]com15 hostnames under kharwadejewellers.comMail: MXSPFDMARC · checked 2026-10-19mail at kharwadejewellers.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-930rm60k-oopgk7ofo-----lvl86pwhnk[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-cfxhu1zy-q3r4h6kbm-----s7env87rmi[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-ftmew3sm-2fexofgrs-----bzalpryr2e[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-g1cuv5vh-nuqr0r6it-----58jwkqdswq[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-l3wkgga8-npg2twp1l-----3p0yff1rmr[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-npxtxkjz-74ectpfbf-----4sdlycfflk[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-ounq3ia7-pwis80v7w-----9dynnasaox[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-qqqzdhtq-rodhq4viq-----9tf8armjoz[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-rofq8w6e-wbbtjgmhe-----lgqad25m2l[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-tebgrf0u-gr1rby7fl-----5to8rvgn1k[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-twmgxsyd-4hleuexj1-----z5imb2ponk[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-vqyza9su-px3tuhhnx-----tqs6gzixtq[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-xb5des4o-ifjxjtqro-----86vcpikiw6[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-y4hmdh7g-zsmcogkvt-----uppj0pqihh[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
linkedin[.]rentMail: MXSPFDMARC · checked 2026-10-19mail at Hostinger (web / mail hosting) · DMARC policy none (monitor only) · sends via Hostinger | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive191.101.104.89 · Confirmed phishing host address (DomainSpoof, 14 days)HostingerHostinger (AS47583) · CY195.35.60.250 · Confirmed phishing host address (DomainSpoof, 14 days)HostingerHostinger (AS47583) · CY2a02:4780:1d:b9ee:b6a8:3fb0:6d4e:283HostingerHostinger (AS47583) · CY2a02:4780:22:a85:fbee:7c2c:4838:dacdHostingerHostinger (AS47583) · CYchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
login-microsoftonline[.]plMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · checked 2026-10-19mail at login-microsoftonline.pl | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive85.128.128.104 · Confirmed phishing host address (DomainSpoof, 14 days)NETARTGROUP (AS15967) · PLstatic-ajw104.rev.nazwa.plchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
loginmicrosoft[.]comMail: MXSPF · checked 2026-10-19mail at Above.com parking (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive103.224.212.107 · Confirmed phishing host address (DomainSpoof, 14 days)Trellian (Above.com parking)Trellian (Above.com parking) (AS133618) · AUlb-212-107.above.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-login[.]itMail: MXSPFDMARC · checked 2026-10-19mail at Proofpoint Essentials (mail security gateway) · DMARC policy quarantine · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive116.202.107.52 · Confirmed phishing host address (DomainSpoof, 14 days)HetznerHetzner (AS24940) · DEstatic.52.107.202.116.clients.your-server.dechecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
watco[.]microsoft-notifcation[.]comMail: MXSPFDMARC · checked 2026-10-19mail at mailhost.spearphish.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive3.145.232.22Amazon Web ServicesAmazon Web Services (AS16509) · USec2-3-145-232-22.us-east-2.compute.amazonaws.com3.145.232.23Amazon Web ServicesAmazon Web Services (AS16509) · USec2-3-145-232-23.us-east-2.compute.amazonaws.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-o365[.]comMail: MXSPFDMARC · checked 2026-10-19mail at OVH (web / mail hosting) · DMARC policy none (monitor only) · sends via OVH, Mailgun | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive213.186.33.5 · Confirmed phishing host address (DomainSpoof, 14 days)OVHOVH (AS16276) · FRredirect.ovh.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-office356[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at microsoft-office356.com · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive91.185.212.27 · Confirmed phishing host address (DomainSpoof, 14 days)TELEMACH-HOSTING (AS41828) · SIbox.webicom.sichecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-office365[.]cloudMail: MXSPF · blocklist.de attackers (all services), blocklist.de mail attackersDMARC · checked 2026-10-19mail at IONOS (web / mail hosting) · DMARC policy none (monitor only) · sends via IONOS | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive217.160.0.235 · Confirmed phishing host address (DomainSpoof, 14 days)IONOSIONOS (AS8560) · DE217-160-0-235.elastic-ssl.ui-r.com2001:8d8:100f:f000::200IONOSIONOS (AS8560) · DE2001-08d8-100f-f000-0000-0000-0000-0200.elastic-ssl.ui-r.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-office365[.]siteMail: MXDMARC · checked 2026-10-19mail at Apple iCloud (consumer mailbox) · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.16.197CloudflareCloudflare (AS13335) · US172.67.215.149CloudflareCloudflare (AS13335) · US2606:4700:3034::ac43:d795CloudflareCloudflare (AS13335) · US2606:4700:3035::6815:10c5CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-se[.]usMail: MXSPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at mail.159.69.26.49 · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive64.191.166.205 · Confirmed phishing host address (DomainSpoof, 14 days)ONERINGNET-ATL-1 (AS35985) · USmetalsdepot.intelliwire.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-sharepoint[.]frMail: MXSPF · checked 2026-10-19mail at OVH (web / mail hosting) · sends via OVH | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive46.105.253.201 · Confirmed phishing host address (DomainSpoof, 14 days)OVHOVH (AS16276) · FRip201.ip-46-105-253.euchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft365-verify[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days) · checked 2026-10-19mail at microsoft365-verify.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive77.90.51.62 · Confirmed phishing host address (DomainSpoof, 14 days)IP-PROJECTS (AS48314) · DE62.51.90.77.hostbrr.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
49 registrable domains · 71 hostnames · page 1 of 2Next →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.