public company · US
Microsoft
MICROSOFT CORP
Software, cloud and productivity services; among the most frequently impersonated brands in phishing reports.
- Primary official domain
- microsoft.com
- Reviewed official domains
- 10 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
111
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
137
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 7/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- hotmaillinkedinmicrosoftoffice365onedriveoutlooksharepoint
- Label aliases
- Hotmail · LinkedIn · Microsoft · Office 365 · OneDrive · Outlook · SharePoint
- Official domains
- microsoft.com · hotmail.com · licdn.com · linkedin.com · live.com · lnkd.in · microsoftonline.com · office.com · +2 more (all)
- Generated spellings
- 400 tracked · 168 observed somewhere · 232 not observed (all)
- Can receive mail
- 55 spellings and 49 reported domains publish MX records · mail at GoDaddy 8 · Google 8 · Microsoft 365 7 · 62 more (168 spellings and 111 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
microsoft365businessbasic[.]comMail: MXSPFDMARC · checked 2026-10-19mail at IONOS (web / mail hosting) · DMARC policy none (monitor only) · sends via IONOS | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive74.208.236.85 · Confirmed phishing host address (DomainSpoof, 14 days)IONOSIONOS (AS8560) · DE74-208-236-85.elastic-ssl.ui-r.com2607:f1c0:100f:f000::200IONOSIONOS (AS8560) · DE2607-f1c0-100f-f000-0000-0000-0000-0200.elastic-ssl.ui-r.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft365updates[.]comMail: MXSPFDMARC · checked 2026-10-19mail at ms53768310.msv1.invalid · DMARC policy none (monitor only) · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.10.231CloudflareCloudflare (AS13335) · US172.67.146.245CloudflareCloudflare (AS13335) · US2606:4700:3032::6815:ae7CloudflareCloudflare (AS13335) · US2606:4700:3035::ac43:92f5CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
login[.]polcu[.]microsoftenline[.]comMail: MXSPFDMARC · checked 2026-10-19mail at GoDaddy (web / mail hosting) · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive34.19.207.32Google CloudGoogle Cloud (AS396982) · US32.207.19.34.bc.googleusercontent.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoftonilne[.]ruMail: MXSPF · checked 2026-10-19mail at Mailgun (sending service) · sends via Mailgun, mailcow.sec-t.ru | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive87.242.79.60 · Confirmed phishing host address (DomainSpoof, 14 days)DTLN (AS49063) · RUchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoftonlimes[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · DMARC policy quarantine · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive108.175.5.157 · Confirmed phishing host address (DomainSpoof, 14 days)IONOSIONOS (AS8560) · DEchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
click5[.]microsoftsupportcenter[.]digitalMail: MXSPF · checked 2026-10-19mail at eye-mail.net (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive172.237.129.108Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-108.ip.linodeusercontent.com172.237.129.236Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-236.ip.linodeusercontent.com172.237.129.242Akamai LinodeAkamai Linode (AS63949) · SG172-237-129-242.ip.linodeusercontent.comchecked 2026-10-19 10:50 UTC | 1 source · 1 record | Details |
microsoftuk[.]coMail: MXSPFDMARC · checked 2026-10-19mail at mail.microsoftuk.co · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive64.191.166.198 · Confirmed phishing host address (DomainSpoof, 14 days)ONERINGNET-ATL-1 (AS35985) · USportal.phishingbox.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoftupdates[.]proMail: MXSPF · checked 2026-10-19mail at mx2.spacemail.com · sends via spf.spacemail.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive93.152.221.222 · Confirmed phishing host address (DomainSpoof, 14 days), Emerging Threats open block listTECHTIES-AS - TechTies Inc. (AS197170) · SCchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft[.]security[.]82a7c75895bc4ad7bbe3a494d299ee52[.]norreply[.]comMail: MXSPFDMARC · checked 2026-10-19mail at www211.your-server.de · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive88.198.84.106 · Confirmed phishing host address (DomainSpoof, 14 days)HetznerHetzner (AS24940) · DEstatic.88.198.84.106.clients.your-server.dechecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
onedrivese[.]onlineMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at onedrivese.online · DMARC policy quarantine · sends via _spf.truehostcloud.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive87.98.143.33 · Confirmed phishing host address (DomainSpoof, 14 days)OVHOVH (AS16276) · FRrbx117b.superfasthost.cloudchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft[.]online-login[.]siteMail: MXSPF · checked 2026-10-19mail at Titan (web / mail hosting) · sends via Titan | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive100.51.185.51Amazon Web ServicesAmazon Web Services (AS14618) · USec2-100-51-185-51.compute-1.amazonaws.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
onmicrosoft[.]live2 hostnames under onmicrosoft.liveMail: MX · checked 2026-10-19mail at OpenSRS (Tucows) (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.40.34.41 · Confirmed phishing host address (DomainSpoof, 14 days)TUCOWS (AS15348) · CAchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
www[.]onmicrosoft[.]live | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.40.34.41 · Confirmed phishing host address (DomainSpoof, 14 days)TUCOWS (AS15348) · CAchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
cpanel[.]outlook-express-repair[.]com3 hostnames under outlook-express-repair.comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days) · checked 2026-10-19mail at outlook-express-repair.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.194.166.12 · Confirmed phishing host address (DomainSpoof, 14 days)INMOTION (AS22611) · USded6460.inmotionhosting.comchecked 2026-10-19 10:50 UTC | 1 source · 1 record | Details |
webmail[.]outlook-express-repair[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.194.166.12 · Confirmed phishing host address (DomainSpoof, 14 days)INMOTION (AS22611) · USded6460.inmotionhosting.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whm[.]outlook-express-repair[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.194.166.12 · Confirmed phishing host address (DomainSpoof, 14 days)INMOTION (AS22611) · USded6460.inmotionhosting.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
outlook-office365[.]ruMail: MXSPF · checked 2026-10-19mail at Mailgun (sending service) · sends via Mailgun, mailcow.sec-t.ru | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive87.242.79.60 · Confirmed phishing host address (DomainSpoof, 14 days)DTLN (AS49063) · RUchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
myweb[.]outlookbase[.]netMail: MXSPF · Confirmed phishing host address (DomainSpoof, 14 days) · checked 2026-10-19mail at Google (consumer mailbox) · sends via se.mschosting.online | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive110.4.45.116 · Confirmed phishing host address (DomainSpoof, 14 days)EXABYTES-AS-AP Exa Bytes Network Sdn.Bhd. (AS46015) · MYaphid.mschosting.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
d0c2283546yus7ngwd0c87v-1drvsharepoint[.]pavonselawgroup[.]comMail: MXSPF · checked 2026-10-19mail at Zoho (consumer mailbox) · sends via Zoho | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.172.101.108 · Confirmed phishing host address (DomainSpoof, 14 days)ROUTERHOSTING (AS14956) · US108.101.172.144.static.cloudzy.comchecked 2026-10-19 10:50 UTC | 1 source · 1 record | Details |
login[.]microsoftonline[.]pintato[.]com[.]arMail: MXSPF · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive68.183.154.148 · Confirmed phishing host address (DomainSpoof, 14 days)DigitalOceanDigitalOcean (AS14061) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
receiptslinkedin[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Titan (web / mail hosting) · DMARC policy none (monitor only) · sends via Titan | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.91.150CloudflareCloudflare (AS13335) · US172.67.223.112CloudflareCloudflare (AS13335) · US2606:4700:3033::ac43:df70CloudflareCloudflare (AS13335) · US2606:4700:3035::6815:5b96CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft-advertising-authentification[.]sgn-1[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Cloudflare Email Routing (mail forwarding) · DMARC policy none (monitor only) · sends via _spf.getresponse.com, Cloudflare Email Routing | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive107.189.18.119 · Confirmed phishing host address (DomainSpoof, 14 days)ROUTERHOSTING (AS14956) · US119.18.189.107.static.cloudzy.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
team-microsoft[.]comMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at mail.team-microsoft.com · DMARC policy none (monitor only) · sends via spf.shockmedia.email | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive31.7.5.103 · Confirmed phishing host address (DomainSpoof, 14 days)PREVIDER-AS (AS20847) · NLtdsynnex.acato.cloud2a03:9700:8000:5::103PREVIDER-AS (AS20847) · NLchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
microsoft[.]account[.]trustedentity[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Microsoft 365 (consumer mailbox) · DMARC policy reject · sends via Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive52.85.193.120Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-120.iad55.r.cloudfront.net52.85.193.34Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-34.iad55.r.cloudfront.net52.85.193.86Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-86.iad55.r.cloudfront.net52.85.193.95Amazon Web ServicesAmazon Web Services (AS16509) · USserver-52-85-193-95.iad55.r.cloudfront.netchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
wwww-linkedin[.]beMail: MXSPFDMARC · checked 2026-10-19mail at mail.wwww-linkedin.be · DMARC policy reject | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive64.238.34.20 · Confirmed phishing host address (DomainSpoof, 14 days)HVC-AS (AS29802) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
hotmail-session-ckgu2ysl-8ueczirgl-----arstocjwsn[.]zoecondominios[.]com[.]br2 hostnames under zoecondominios.com.brMail: MXSPFDMARC · checked 2026-10-19mail at zoecondominios.com.br · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive87.120.36.175 · Confirmed phishing host address (DomainSpoof, 14 days)AS-WAF (AS210546) · GBchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd[.]zoecondominios[.]com[.]br | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive87.120.36.175 · Confirmed phishing host address (DomainSpoof, 14 days)AS-WAF (AS210546) · GBchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
401283-outlookmailbox-00012-validate[.]weebly[.]com3 hostnames under weebly.comMail: MXSPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy none (monitor only) · sends via Google, Zendesk, _netblocks.sparkpostmail.com, SendGrid | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-10-16Source reported | Alive74.115.51.8WeeblyWeebly (AS27647) · USwildcard.weebly.com74.115.51.9WeeblyWeebly (AS27647) · USwildcard.weebly.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
connexioncompteoutlook[.]weebly[.]com | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-09-27Source reported | Alive74.115.51.8WeeblyWeebly (AS27647) · USwildcard.weebly.com74.115.51.9WeeblyWeebly (AS27647) · USwildcard.weebly.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
connectezvousamicrosoftoutlook[.]weebly[.]com | Reported by PhishTankPresent in latest snapshot | Strong matchBrand in hostname | 2026-09-21Source reported | Alive74.115.51.8WeeblyWeebly (AS27647) · USwildcard.weebly.com74.115.51.9WeeblyWeebly (AS27647) · USwildcard.weebly.comchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
49 registrable domains · 71 hostnames · page 2 of 2← Previous
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.