public company · US
Microsoft
MICROSOFT CORP
Software, cloud and productivity services; among the most frequently impersonated brands in phishing reports.
- Primary official domain
- microsoft.com
- Reviewed official domains
- 10 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
111
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
137
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 7/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- hotmaillinkedinmicrosoftoffice365onedriveoutlooksharepoint
- Label aliases
- Hotmail · LinkedIn · Microsoft · Office 365 · OneDrive · Outlook · SharePoint
- Official domains
- microsoft.com · hotmail.com · licdn.com · linkedin.com · live.com · lnkd.in · microsoftonline.com · office.com · +2 more (all)
- Generated spellings
- 400 tracked · 168 observed somewhere · 232 not observed (all)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
019252-microsoft[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.33.17172.67.157.1512606:4700:3033::ac43:9d972606:4700:3037::6815:2111checked 2026-10-19 04:55 UTC | 1 source · 1 record | Details |
676132-microsoft[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.46.214172.67.142.862606:4700:3032::6815:2ed62606:4700:3037::ac43:8e56checked 2026-10-19 04:55 UTC | 1 source · 1 record | Details |
account-micro-soft[.]comMail: SPFDMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive52.72.49.79checked 2026-10-19 04:55 UTC | 1 source · 1 record | Details |
app-microsoft-edge[.]com[.]cnMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive154.26.225.176checked 2026-10-19 04:55 UTC | 1 source · 1 record | Details |
authenticateonmicrosoft[.]comMail: MXSPF · via tu-media.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive172.67.222.223104.21.54.232606:4700:3034::6815:36172606:4700:3031::ac43:dedfchecked 2026-10-19 04:47 UTC | 1 source · 1 record | Details |
microsoft[.]authorised-support[.]com2 hostnames under authorised-support.comMail: MXSPFDMARC · via outlook.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive52.85.193.12052.85.193.3452.85.193.8652.85.193.95checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoftquarantine[.]authorised-support[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive52.85.193.12052.85.193.3452.85.193.8652.85.193.95checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
2yus7ngwd0c87vd1drvsharepoint[.]capitolelectrics[.]com2 hostnames under capitolelectrics.comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.172.105.161checked 2026-10-19 04:55 UTC | 1 source · 1 record | Details |
doc53usngwd0c85bdrvsharepoint[.]capitolelectrics[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.172.105.161checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
2yus7ngwd0c87v-1drvsharepoint[.]carestakerinc[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.172.102.112checked 2026-10-19 04:55 UTC | 1 source · 1 record | Details |
china-microsoft[.]comMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.241.123.170checked 2026-10-19 04:48 UTC | 1 source · 1 record | Details |
microsoft[.]comunicazioni-sicure[.]itMail: MXSPFDMARC · via comunicazioni-sicure.it · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive34.240.138.15552.48.92.20654.77.191.63checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
connect-microsoft[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive153.236.181.1512001:240:2405:da28:4ff0:f8ed:45ed:8be6checked 2026-10-19 04:49 UTC | 1 source · 1 record | Details |
2yus7ngwd0c87v-1drvsharepoint[.]deemfirsts[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive165.232.102.9checked 2026-10-19 04:55 UTC | 1 source · 1 record | Details |
microsoftmailops[.]empiremagnetlcs[.]com2 hostnames under empiremagnetlcs.comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.172.116.19checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
w0m8h7u5a9-my-sharepoint[.]empiremagnetlcs[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.172.116.19checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft[.]empowerbydxc[.]comMail: MX · via secureserver.net · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.118.112.246checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft[.]update[.]eutelnet[.]infoMail: MXSPF · via eutelnet.info · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoftweb365[.]fwh[.]isMail: MXSPF · via ifastnet11.org · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive199.59.243.225checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
docssharepoints[.]highlandsthreads[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive209.97.186.249checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
cae3a120d99f49be8cad1d70ea72bec5mn-my-sharepoint[.]hlmillersinc[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive178.62.96.111checked 2026-10-19 04:48 UTC | 1 source · 1 record | Details |
login[.]microsoftonline[.]hmvegn[.]ieMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.82.96.115checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail143[.]netMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.45.148172.67.215.1282606:4700:3033::ac43:d7802606:4700:3037::6815:2d94checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmailmart[.]comMail: MXSPFDMARC · via hotmailmart.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.246.188.8checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
howtoauthorizemicrosoftinfo[.]comMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive13.248.243.576.223.105.230checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
outlook-email-2026[.]hstn[.]meMail: MXSPF · via ifastnet.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft365xx1[.]iceiy[.]com2 hostnames under iceiy.comMail: MXSPF · via iceiy.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
outlook365verificationmethod[.]iceiy[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
office365[.]internal-alerts[.]comMail: SPFDMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.50.64.14checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
111 registrable domains · 138 hostnames · page 1 of 5Next →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.