public company · US
Microsoft
MICROSOFT CORP
Software, cloud and productivity services; among the most frequently impersonated brands in phishing reports.
- Primary official domain
- microsoft.com
- Reviewed official domains
- 10 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
111
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
1
domains first source-reported within 30 days
First observed, 30 days
137
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 7/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- hotmaillinkedinmicrosoftoffice365onedriveoutlooksharepoint
- Label aliases
- Hotmail · LinkedIn · Microsoft · Office 365 · OneDrive · Outlook · SharePoint
- Official domains
- microsoft.com · hotmail.com · licdn.com · linkedin.com · live.com · lnkd.in · microsoftonline.com · office.com · +2 more (all)
- Generated spellings
- 400 tracked · 168 observed somewhere · 232 not observed (all)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
microsoftuk[.]coMail: MXSPFDMARC · via microsoftuk.co · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive64.191.166.198checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoftupdater[.]infoMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.239.83.200checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoftupdates[.]proMail: MXSPF · via spacemail.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive93.152.221.222checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
mmicrosoft[.]coMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive13.248.243.576.223.105.230checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft[.]security[.]82a7c75895bc4ad7bbe3a494d299ee52[.]norreply[.]comMail: MXSPFDMARC · via your-server.de · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive88.198.84.106checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
office365microsoftlogin[.]comMail: DMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive172.197.176.182checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
onedrivese[.]onlineMail: MXSPFDMARC · via onedrivese.online · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive87.98.143.33checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft[.]online-login[.]siteMail: MXSPF · via titan.email · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive100.51.185.51checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
onmicrosoft[.]live2 hostnames under onmicrosoft.liveMail: MX · via hostedemail.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.40.34.41checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
www[.]onmicrosoft[.]live | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.40.34.41checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
out-look-2026[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
outlook-apps[.]netMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive146.19.125.42checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
cpanel[.]outlook-express-repair[.]com3 hostnames under outlook-express-repair.comMail: MXSPF · via outlook-express-repair.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.194.166.12checked 2026-10-19 04:49 UTC | 1 source · 1 record | Details |
webmail[.]outlook-express-repair[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.194.166.12checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
whm[.]outlook-express-repair[.]com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.194.166.12checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
outlook-office365[.]ruMail: MXSPF · via mailgun.org · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive87.242.79.60checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
myweb[.]outlookbase[.]netMail: MXSPF · via googlemail.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive110.4.45.116checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
outlookmail[.]socialMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive192.0.73.10192.0.73.20checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
d0c2283546yus7ngwd0c87v-1drvsharepoint[.]pavonselawgroup[.]comMail: MXSPF · via zoho.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive144.172.101.108checked 2026-10-19 04:49 UTC | 1 source · 1 record | Details |
login[.]microsoftonline[.]pintato[.]com[.]arMail: MXSPF · via outlook.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive68.183.154.148checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoftword[.]programgridsoft[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.40.155.13checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
receiptslinkedin[.]comMail: MXSPFDMARC · via titan.email · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.91.150172.67.223.1122606:4700:3033::ac43:df702606:4700:3035::6815:5b96checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
office365[.]rricrosoft-offices[.]orgMail: SPFDMARC · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive20.50.64.14checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
microsoft-advertising-authentification[.]sgn-1[.]comMail: MXSPFDMARC · via cloudflare.net · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive107.189.18.119checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
start-linkedin[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
team-microsoft[.]comMail: MXSPFDMARC · via team-microsoft.com · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive31.7.5.1032a03:9700:8000:5::103checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
teams-meeting-microsoft[.]comMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.83.14172.67.166.1982606:4700:3034::ac43:a6c62606:4700:3035::6815:530echecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
teams-microsoft[.]coMail: No mail records · checked 2026-10-19 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.2.9172.67.128.1252606:4700:3032::ac43:807d2606:4700:3037::6815:209checked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
111 registrable domains · 138 hostnames · page 4 of 5← PreviousNext →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.