public company · US
Microsoft
MICROSOFT CORP
Software, cloud and productivity services; among the most frequently impersonated brands in phishing reports.
- Primary official domain
- microsoft.com
- Reviewed official domains
- 10 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
111
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
137
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 7/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- hotmaillinkedinmicrosoftoffice365onedriveoutlooksharepoint
- Label aliases
- Hotmail · LinkedIn · Microsoft · Office 365 · OneDrive · Outlook · SharePoint
- Official domains
- microsoft.com · hotmail.com · licdn.com · linkedin.com · live.com · lnkd.in · microsoftonline.com · office.com · +2 more (all)
- Generated spellings
- 400 tracked · 168 observed somewhere · 232 not observed (all)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
invreceiptslinkedin[.]comMail: MXSPF · via outlook.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.51.13172.67.216.992606:4700:3032::ac43:d8632606:4700:3033::6815:330dchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
eaea4a850d44f00be8cad1d70ea72bcc-my-sharepoint[.]isomerlcindustries[.]comMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
sharepointonedriveaaqkada0yja1yji5l[.]jamejampaintingservice[.]com[.]auMail: MXSPFDMARC · via jamejampaintingservice.com.au · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive192.185.84.51checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
onedrivedoccloud[.]kesug[.]comMail: MXSPF · via ifastnet11.org · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-5vwfq9rf-ns1oada3v-----hzlj11wwvw[.]kharwadejewellers[.]com15 hostnames under kharwadejewellers.comMail: MXSPFDMARC · via kharwadejewellers.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-930rm60k-oopgk7ofo-----lvl86pwhnk[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-cfxhu1zy-q3r4h6kbm-----s7env87rmi[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-ftmew3sm-2fexofgrs-----bzalpryr2e[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-g1cuv5vh-nuqr0r6it-----58jwkqdswq[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-l3wkgga8-npg2twp1l-----3p0yff1rmr[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-npxtxkjz-74ectpfbf-----4sdlycfflk[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-ounq3ia7-pwis80v7w-----9dynnasaox[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-qqqzdhtq-rodhq4viq-----9tf8armjoz[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-rofq8w6e-wbbtjgmhe-----lgqad25m2l[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-tebgrf0u-gr1rby7fl-----5to8rvgn1k[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-twmgxsyd-4hleuexj1-----z5imb2ponk[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-vqyza9su-px3tuhhnx-----tqs6gzixtq[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-xb5des4o-ifjxjtqro-----86vcpikiw6[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
hotmail-session-y4hmdh7g-zsmcogkvt-----uppj0pqihh[.]kharwadejewellers[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
linkedin[.]rentMail: MXSPFDMARC · via hostinger.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive191.101.104.120195.35.60.1542a02:4780:1e:6086:f817:2dab:e8c1:85632a02:4780:22:5ee9:48bb:e86d:95ae:fe96checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
live-hotmail[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.53.179.136checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
login-faxplus-outlook[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive52.191.175.126checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
login-microsoftonline[.]plMail: MXSPF · via login-microsoftonline.pl · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive85.128.128.104checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
loginmicrosoft[.]comMail: MXSPF · via above.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive103.224.212.107checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
login[.]loginmicrosoftonline[.]ukMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive81.31.99.169checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
ww547[.]loutlook[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive34.160.121.137checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
emailnotifications[.]m365-microsoft[.]com4 hostnames under m365-microsoft.comMail: SPFDMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.50.64.14checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
programme-hup[.]m365-microsoft[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.50.64.14checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
security[.]m365-microsoft[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.50.64.14checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
support[.]m365-microsoft[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.50.64.14checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
manychatforlinkedin[.]comMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.150.1.1checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsofonedrive[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive13.248.213.4576.223.67.189checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-certification[.]comMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive156.241.108.119checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-desk[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive34.68.218.70checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-login[.]itMail: MXSPFDMARC · via ppe-hosted.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive116.202.107.52checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
watco[.]microsoft-notifcation[.]comMail: MXSPFDMARC · via spearphish.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive3.145.232.223.145.232.23checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-o365[.]comMail: MXSPFDMARC · via ovh.net · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive213.186.33.5checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-office-setup[.]comMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive46.202.141.237checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-office356[.]comMail: MXSPFDMARC · via microsoft-office356.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive91.185.212.27checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-office365[.]cloudMail: MXSPFDMARC · via ionos.de · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive217.160.0.2352001:8d8:100f:f000::200checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-office365[.]siteMail: MXDMARC · via icloud.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.16.197172.67.215.1492606:4700:3034::ac43:d7952606:4700:3035::6815:10c5checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-se[.]usMail: MXSPFDMARC · via 26.49 · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive64.191.166.205checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
111 registrable domains · 138 hostnames · page 2 of 5← PreviousNext →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.