Microsoft

Software & cloud United Statesmicrosoft.comRank 1 of the most impersonated
Cert findings · 24 h
11
Cert findings · 7 days
118
64 reported or listed · 50 on phishing hosts · 4 on Spamhaus DROP
Registered lookalikes
1,670
121 listed by a source or an address list
Official domains
576
verified from Microsoft's own sites and records

Registered lookalikes

Checked daily · 2026-11-04 22:41 UTC

Spellings of Microsoft's official domains (microsoft.com, office365.com, hotmail.com, …) registered to other owners (identified by nameservers, registrar and redirects), checked daily; the ones with no address or mail server yet say so. Many are parked, for sale or run by other businesses and sites with a similar name; the ones a phishing source or address list has flagged carry a label.

Some of these come from registry zone files (ICANN CZDS). Our zone data terms apply to them: no marketing use of any kind, no harassing their registrants, no high-volume registry or registrar queries.

121 of the 1,670 are listed by a source or resolve to a listed address, checked hourly.

  1. microsoftsupport.digital SG · AS63949 · Akamai Connected Cloud3 addressesLookalike of microsoft.com · the name with an added word
    Listed by MetaMask3 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    microsoftsupport.digital
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-03 · the day the .digital zone file first listed it as a new registration
    Registered
    2026-11-02 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftsupport.digital · in the feed since 2026-11-03 17:48 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (microsoftsupport.digital resolved to it 2026-11-04 21:37 UTC), 172.232.24.235 (microsoftsupport.digital resolved to it 2026-11-04 21:37 UTC), 172.234.25.42 (microsoftsupport.digital resolved to it 2026-11-04 21:37 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  2. hotmaill.live CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of hotmail.com · a doubled letter
    Address on DomainSpoof’s phishing-host listHostingerMX present
    DetailsHide
    Domain
    hotmaill.live
    Spelling
    Spelled like hotmail.com with a doubled letter
    First found
    2026-11-02 · the day the .live zone file first listed it as a new registration
    Registered
    2026-11-01 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmaill.live resolved to it 2026-11-04 16:24 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx1.hostinger.com
    mx2.hostinger.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  3. microshoft.cloud FR · AS16276 · OVH OVH SASLookalike of microsoft.com · an added character
    Listed by MetaMaskOVHMX present
    DetailsHide
    Domain
    microshoft.cloud
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .cloud zone file, already registered
    Registered
    2026-10-30 · OVH sas
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microshoft.cloud · in the feed since 2026-11-01 11:44 UTC
    Addresses
    213.186.33.5 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (213.186.33.5): a cloud provider. It rents servers and addresses to its customers.
    MX
    mx1.mail.ovh.net
    mx2.mail.ovh.net
    mx3.mail.ovh.net
    Daily check
    Ended 2026-11-04 22:41 UTC
  4. sharedpoint.top SG · AS63949 · Akamai Connected Cloud3 addressesLookalike of microsoft.com · an added character
    3 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    sharedpoint.top
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-10-29 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (sharedpoint.top resolved to it 2026-11-05 00:46 UTC), 172.232.24.235 (sharedpoint.top resolved to it 2026-11-05 00:46 UTC), 172.234.25.42 (sharedpoint.top resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  5. microsoftonline.si US · AS16509 · Amazon.com, Inc.2 addressesLookalike of microsoftonline.com · the ending .si
    Listed by MetaMaskAmazon Web Services
    DetailsHide
    Domain
    microsoftonline.si
    Spelling
    The name of microsoftonline.com with the ending .si
    First found
    2026-10-31 · the day the daily DNS check first found it registered
    Registered
    2026-10-29 · GoDaddy.com LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftonline.si · in the feed since 2026-10-29 23:38 UTC
    Addresses
    3.33.130.190 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    15.197.148.33 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (3.33.130.190, 15.197.148.33): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  6. outlook.gift SG · AS63949 · Akamai Connected Cloud3 addressesLookalike of outlook.com · the ending .gift
    3 addresses on DomainSpoof’s phishing-host listAkamai LinodeMX present
    DetailsHide
    Domain
    outlook.gift
    Spelling
    The name of outlook.com with the ending .gift
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Registered
    2026-10-25 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (outlook.gift resolved to it 2026-11-01 22:00 UTC), 172.232.24.235 (outlook.gift resolved to it 2026-11-01 22:00 UTC), 172.234.25.42 (outlook.gift resolved to it 2026-11-01 22:00 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    MX
    mx.checker.in
    Daily check
    Ended 2026-11-04 22:41 UTC
  7. microsofts.bondLookalike of microsoft.com · an added character
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsofts.bond
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .bond zone file, already registered
    Registered
    2026-10-18 · Gname.com Pte. Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsofts.bond · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  8. microsofts.buzz US · AS13335 · Cloudflare, Inc.Lookalike of microsoft.com · an added character
    Listed by MetaMaskCloudflare
    DetailsHide
    Domain
    microsofts.buzz
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .buzz zone file, already registered
    Registered
    2026-10-18 · Gname.com Pte. Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsofts.buzz · in the feed since 2026-10-27 05:34 UTC
    Addresses
    172.65.235.97 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (172.65.235.97): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Daily check
    Ended 2026-11-04 22:41 UTC
  9. microsoft-auth.support DE · AS212317 · HETZNER-CLOUD3-AS Hetzner O…Lookalike of microsoft.com · the name with the word “auth”
    Listed by MetaMaskRegistry lookup queuedMX present
    DetailsHide
    Domain
    microsoft-auth.support
    Spelling
    The name of microsoft.com with the word “auth”
    First found
    2026-11-01 · the day we first found it in the .support zone file, already registered
    Registered
    2026-10-08 · GoDaddy.com, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-auth.support · in the feed since 2026-10-27 05:34 UTC
    Addresses
    5.78.132.160 · Germany · AS212317 HETZNER-CLOUD3-AS Hetzner Online GmbH
    MX
    mail.microsoft-auth.support
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  10. login-microsoft-verify.onlineLookalike of microsoft.com · the name with an added word
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    login-microsoft-verify.online
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2026-09-27 · Cloudflare, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · login-microsoft-verify.online · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  11. outlook.yt CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of outlook.com · the ending .yt
    Address on DomainSpoof’s phishing-host listHostingerMX present
    DetailsHide
    Domain
    outlook.yt
    Spelling
    The name of outlook.com with the ending .yt
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Registered
    2026-09-27 · Realtime Register B.V.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · outlook.yt resolved to it 2026-11-01 22:00 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx1.hostinger.com
    mx2.hostinger.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  12. microsoft-update.downloadLookalike of microsoft.com · the name with the word “update”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoft-update.download
    Spelling
    The name of microsoft.com with the word “update”
    First found
    2026-11-01 · the day we first found it in the .download zone file, already registered
    Registered
    2026-09-23 · Cloudflare, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-update.download · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  13. miorosoft.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of microsoft.com · a changed character
    Address on DomainSpoof’s phishing-host listHostingerMX present
    DetailsHide
    Domain
    miorosoft.online
    Spelling
    Spelled like microsoft.com with a changed character
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2026-09-23 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · miorosoft.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mail.getclicksafe.online
    Daily check
    Ended 2026-11-04 22:41 UTC
  14. offece365.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of microsoft.com · a changed character
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    offece365.online
    Spelling
    Spelled like microsoft.com with a changed character
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2026-09-19 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · offece365.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  15. microsoftt.icu US · AS13335 · Cloudflare, Inc.4 addressesLookalike of microsoft.com · a doubled letter
    Listed by MetaMaskCloudflare
    DetailsHide
    Domain
    microsoftt.icu
    Spelling
    Spelled like microsoft.com with a doubled letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-08-13 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftt.icu · in the feed since 2026-10-27 05:34 UTC
    Addresses
    104.21.26.173 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.138.35 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::6815:1aad
    2606:4700:3033::ac43:8a23
    Cloudflare
    Cloudflare (104.21.26.173, 172.67.138.35): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Daily check
    Ended 2026-11-04 22:41 UTC
  16. microsoftf.org DE · AS47846 · SEDO-AS SEDO GmbHLookalike of microsoft.com · an added character
    Listed by MetaMaskParking page · Sedo
    DetailsHide
    Domain
    microsoftf.org
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .org zone file, already registered
    Registered
    2026-08-10 · Name.com, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftf.org · in the feed since 2026-10-27 05:34 UTC
    Addresses
    91.195.240.94 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.94): a parking service. It answers for names that are typically for sale or unused.
    Daily check
    Ended 2026-11-04 22:41 UTC
  17. 0utl00k.org SG · AS63949 · Akamai Connected Cloud3 addressesLookalike of outlook.com · similar-looking characters
    3 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    0utl00k.org
    Spelling
    Spelled like outlook.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-07-23 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (0utl00k.org resolved to it 2026-11-04 19:10 UTC), 172.232.24.235 (0utl00k.org resolved to it 2026-11-04 19:10 UTC), 172.234.25.42 (0utl00k.org resolved to it 2026-11-04 19:10 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  18. micros0ft.helpLookalike of microsoft.com · similar-looking characters
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    micros0ft.help
    Spelling
    Spelled like microsoft.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-07-16 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · micros0ft.help · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  19. hotmail-com-login.email DE · AS212317 · HETZNER-CLOUD3-AS Hetzner O…14 addressesLookalike of microsoft.com · the name with an added word
    5 addresses on DomainSpoof’s phishing-host listHetzner +1
    DetailsHide
    Domain
    hotmail-com-login.email
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .email zone file, already registered
    Registered
    2026-07-06 · Domain Science Kutatási Szolgáltató Korlátolt Felelősségű Társaság
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    5 addresses on DomainSpoof’s phishing-host list
    195.201.128.179 (hotmail-com-login.email resolved to it 2026-11-05 00:46 UTC), 46.62.237.138 (hotmail-com-login.email resolved to it 2026-11-05 00:46 UTC), 5.161.230.87 (hotmail-com-login.email resolved to it 2026-11-05 00:46 UTC), 5.161.47.86 (hotmail-com-login.email resolved to it 2026-11-05 00:46 UTC), 5.78.156.59 (hotmail-com-login.email resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    5.78.156.59 · Germany · AS212317 HETZNER-CLOUD3-AS Hetzner Online GmbH
    5.161.47.86 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    5.161.230.87 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    46.62.237.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    76.223.91.20 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    195.201.128.179 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    2406:da1e:214:c901:49:871:e9e1:eb92
    2600:1f1c:6db:8801:ca20:5f5a:5f45:48d0
    2a05:d014:179b:c400:b5e:feaf:a6dc:b508
    2a05:d014:179b:c400:2dc9:16fd:7cbd:e255
    2a05:d014:179b:c400:5ed8:1db0:4443:ca25
    2a05:d014:179b:c400:a327:40ee:24cc:6180
    2a05:d014:179b:c400:aa99:a226:6c94:e72
    2a05:d014:179b:c400:adda:f567:8e83:5e24
    Hetzner +1
    Hetzner (46.62.237.138, 195.201.128.179): a cloud provider. It rents servers and addresses to its customers. Amazon Web Services (76.223.91.20): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  20. microsoftteamservice.org US · AS16509 · Amazon.com, Inc.Lookalike of microsoft.com · the name with an added word
    Listed by MetaMaskReported by PhishDestroyAmazon Web Services
    DetailsHide
    Domain
    microsoftteamservice.org
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .org zone file, already registered
    Registered
    2026-06-26 · Cloudflare, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftteamservice.org · in the feed since 2026-10-27 05:34 UTC
    Reported by PhishDestroy
    Reported by PhishDestroy · microsoftteamservice.org · in the feed since 2026-10-25 23:31 UTC
    Addresses
    75.2.60.5 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (75.2.60.5): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  21. micros0ft.cloud US · AS13335 · Cloudflare, Inc.4 addressesLookalike of microsoft.com · similar-looking characters
    Listed by MetaMaskCloudflare
    DetailsHide
    Domain
    micros0ft.cloud
    Spelling
    Spelled like microsoft.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-06-17 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · micros0ft.cloud · in the feed since 2026-10-27 05:34 UTC
    Addresses
    104.21.88.17 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.150.34 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:5811
    2606:4700:3032::ac43:9622
    Cloudflare
    Cloudflare (104.21.88.17, 172.67.150.34): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Daily check
    Ended 2026-11-04 22:41 UTC
  22. rnicrosoftonline.us CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of microsoftonline.com · similar-looking characters
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    rnicrosoftonline.us
    Spelling
    Spelled like microsoftonline.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-06-10 · Hosting Concepts B.V. d/b/a Registrar.eu
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · rnicrosoftonline.us resolved to it 2026-11-04 18:10 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  23. microsofts.momLookalike of microsoft.com · an added character
    Listed by MetaMaskMX present
    DetailsHide
    Domain
    microsofts.mom
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .mom zone file, already registered
    Registered
    2026-05-29 · Gname.com Pte. Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsofts.mom · in the feed since 2026-10-27 05:34 UTC
    MX
    microsofts-mom.mail.protection.outlook.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  24. microsofts.cyouLookalike of microsoft.com · an added character
    Listed by MetaMaskMX present
    DetailsHide
    Domain
    microsofts.cyou
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .cyou zone file, already registered
    Registered
    2026-05-24 · Gname.com Pte. Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsofts.cyou · in the feed since 2026-10-27 05:34 UTC
    MX
    microsofts-cyou.mail.protection.outlook.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  25. microsoft-secure.orgLookalike of microsoft.com · the name with the word “secure”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoft-secure.org
    Spelling
    The name of microsoft.com with the word “secure”
    First found
    2026-11-01 · the day we first found it in the .org zone file, already registered
    Registered
    2026-05-23 · Cloudflare, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-secure.org · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  26. microsofts.cfdLookalike of microsoft.com · an added character
    Listed by MetaMaskMX present
    DetailsHide
    Domain
    microsofts.cfd
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .cfd zone file, already registered
    Registered
    2026-05-14 · Gname.com Pte. Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsofts.cfd · in the feed since 2026-10-27 05:34 UTC
    MX
    microsofts-cfd.mail.protection.outlook.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  27. micros0ft.sbs DE · AS47846 · SEDO-AS SEDO GmbHLookalike of microsoft.com · similar-looking characters
    Listed by MetaMaskParking page · Sedo
    DetailsHide
    Domain
    micros0ft.sbs
    Spelling
    Spelled like microsoft.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-05-14 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · micros0ft.sbs · in the feed since 2026-10-27 05:34 UTC
    Addresses
    91.195.240.123 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.123): a parking service. It answers for names that are typically for sale or unused.
    Daily check
    Ended 2026-11-04 22:41 UTC
  28. office365-update.org US · AS22612 · Namecheap, Inc.Lookalike of microsoft.com · the name with an added word
    Listed by MetaMaskNamecheapMX present
    DetailsHide
    Domain
    office365-update.org
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .org zone file, already registered
    Registered
    2026-05-06 · NameCheap, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · office365-update.org · in the feed since 2026-10-27 05:34 UTC
    Addresses
    209.74.87.236 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (209.74.87.236): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    office365-update.org
    Daily check
    Ended 2026-11-04 22:41 UTC
  29. microssoft.live US · AS396982 · Google LLCLookalike of microsoft.com · a doubled letter
    Listed by MetaMaskReported by PhishDestroyGoogle Cloud
    DetailsHide
    Domain
    microssoft.live
    Spelling
    Spelled like microsoft.com with a doubled letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-05-05 · Unstoppable Domains Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microssoft.live · in the feed since 2026-10-27 05:34 UTC
    Reported by PhishDestroy
    Reported by PhishDestroy · microssoft.live · in the feed since 2026-10-25 23:31 UTC
    Addresses
    34.68.218.70 · United States · AS396982 GOOGLE-CLOUD-PLATFORM - Google LLC · Google Cloud (cloud provider)
    Google Cloud
    Google Cloud (34.68.218.70): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  30. mmicrosoft.co US · AS16509 · Amazon.com, Inc.2 addressesLookalike of microsoft.com · a doubled letter
    Listed by MetaMaskReported by PhishDestroyAmazon Web Services
    DetailsHide
    Domain
    mmicrosoft.co
    Spelling
    Spelled like microsoft.com with a doubled letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-05-05 · GoDaddy.com, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · mmicrosoft.co · in the feed since 2026-10-27 05:34 UTC
    Reported by PhishDestroy
    Reported by PhishDestroy · mmicrosoft.co · in the feed since 2026-10-25 23:31 UTC
    Addresses
    13.248.243.5 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.105.230 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.243.5, 76.223.105.230): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  31. microsofft.cloud IT · AS31034 · ARUBA-ASN Aruba S.p.A.Lookalike of microsoft.com · a doubled letter
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsofft.cloud
    Spelling
    Spelled like microsoft.com with a doubled letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-04-20 · Tucows Domains Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    62.149.189.55 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsofft.cloud resolved to it 2026-11-04 18:09 UTC
    Addresses
    62.149.189.55 · Italy · AS31034 ARUBA-ASN Aruba S.p.A.
    MX
    mx.microsofft.cloud
    Daily check
    Ended 2026-11-04 22:41 UTC
  32. micerosoft.live US · AS22612 · Namecheap, Inc.Lookalike of microsoft.com · an added character
    Listed by MetaMaskNamecheap
    DetailsHide
    Domain
    micerosoft.live
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-04-13 · Spaceship, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · micerosoft.live · in the feed since 2026-10-27 05:34 UTC
    Addresses
    104.207.76.65 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (104.207.76.65): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  33. login-hotmaii.com DE · AS206834 · TEAMINTERNET-CA-AS Team Int…Lookalike of hotmail.com · similar-looking characters
    Reported by PhishDestroyParking page · ParkingCrew (Team Internet)
    DetailsHide
    Domain
    login-hotmaii.com
    Spelling
    Spelled like hotmail.com with similar-looking characters
    First found
    2026-10-30 · the day DomainSpoof first saw a certificate naming it
    Registered
    2026-03-23 · Hosting Concepts B.V. d/b/a Registrar.eu
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Reported by PhishDestroy
    Reported by PhishDestroy · login-hotmaii.com · in the feed since 2026-10-25 23:31 UTC
    Addresses
    185.53.179.136 · Germany · AS206834 TEAMINTERNET-CA-AS Team Internet AG · ParkingCrew (Team Internet) (parking page)
    Parking page · ParkingCrew (Team Internet)
    ParkingCrew (Team Internet) (185.53.179.136): a parking service. It answers for names that are typically for sale or unused.
    Daily check
    Ended 2026-11-04 22:41 UTC
  34. microsot.store CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of microsoft.com · a dropped letter
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    microsot.store
    Spelling
    Spelled like microsoft.com with a dropped letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-03-04 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsot.store resolved to it 2026-11-04 18:09 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  35. microsoftonlline.xyz TR · AS51557 · TR-ISIMTESCIL-20201202 Isim…Lookalike of microsoftonline.com · a doubled letter
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoftonlline.xyz
    Spelling
    Spelled like microsoftonline.com with a doubled letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-02-27 · İsimtescil Bilişim A.Ş.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    93.89.226.17 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoftonlline.xyz resolved to it 2026-11-04 18:10 UTC
    Addresses
    93.89.226.17 · Türkiye · AS51557 TR-ISIMTESCIL-20201202 Isimtescil Bilisim A.S.
    Daily check
    Ended 2026-11-04 22:41 UTC
  36. mlcrosoft.site JP · AS9370 · SAKURA Internet Inc.Lookalike of microsoft.com · similar-looking characters
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    mlcrosoft.site
    Spelling
    Spelled like microsoft.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2026-01-19 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    160.16.200.77 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · mlcrosoft.site resolved to it 2026-11-04 18:09 UTC
    Addresses
    160.16.200.77 · Japan · AS9370 SAKURA-B - SAKURA Internet Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  37. microsoft365.no GB · AS48254 · TWENTYI 20i Limited2 addressesLookalike of microsoft365.com · the ending .no
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsoft365.no
    Spelling
    The name of microsoft365.com with the ending .no
    First found
    2026-10-31 · the day the daily DNS check first found it registered
    Registered
    2025-12-27 · SMOOTH GRUPPEN AS
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    185.151.30.176 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft365.no resolved to it 2026-11-05 05:18 UTC
    Addresses
    185.151.30.176 · United Kingdom · AS48254 TWENTYI 20i Limited
    2a07:7800::176
    MX
    mx.stackmail.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  38. service-microsoft-babylon.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with an added word
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    service-microsoft-babylon.xyz
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · service-microsoft-babylon.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  39. service-microsoft-death.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with an added word
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    service-microsoft-death.xyz
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · service-microsoft-death.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  40. simulink-bank-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “simulink-bank”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    simulink-bank-microsoft.xyz
    Spelling
    The name of microsoft.com with the word “simulink-bank”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · simulink-bank-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  41. kotlin-microsoft-service.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with an added word
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    kotlin-microsoft-service.xyz
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · kotlin-microsoft-service.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  42. meteor-microsoft-package.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with an added word
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    meteor-microsoft-package.xyz
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · meteor-microsoft-package.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  43. microsoft-invoice-elixir.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “invoice-elixir”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoft-invoice-elixir.xyz
    Spelling
    The name of microsoft.com with the word “invoice-elixir”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-invoice-elixir.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  44. microsoft-ledger-claim.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “ledger-claim”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoft-ledger-claim.xyz
    Spelling
    The name of microsoft.com with the word “ledger-claim”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-ledger-claim.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  45. microsoft-on-service.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “on-service”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoft-on-service.xyz
    Spelling
    The name of microsoft.com with the word “on-service”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-on-service.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  46. microsoft-payment-out.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “payment-out”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoft-payment-out.xyz
    Spelling
    The name of microsoft.com with the word “payment-out”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-payment-out.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  47. microsoft-security.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “security”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoft-security.xyz
    Spelling
    The name of microsoft.com with the word “security”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-security.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  48. microsoft-service.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “service”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoft-service.xyz
    Spelling
    The name of microsoft.com with the word “service”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-service.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  49. billing-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Lookalike of microsoft.com · the name with the word “billing”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    billing-microsoft.xyz
    Spelling
    The name of microsoft.com with the word “billing”
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-07 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · billing-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  50. rnicrosoft.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Lookalike of microsoft.com · similar-looking characters
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    rnicrosoft.pl
    Spelling
    Spelled like microsoft.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2025-12-06 · Aftermarket.pl Limited
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    185.253.212.22 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · rnicrosoft.pl resolved to it 2026-11-04 18:09 UTC
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    MX
    blackhole.aftermarket.pl
    Daily check
    Ended 2026-11-04 22:41 UTC
  51. one2drive.online DE · AS6724 · STRATO Strato GmbH2 addressesLookalike of microsoft.com · an added character
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    one2drive.online
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2025-11-13 · InterNetX GmbH
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    81.169.145.150 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · one2drive.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    81.169.145.150 · Germany · AS6724 STRATO Strato GmbH
    2a01:238:20a:202:1150::
    MX
    smtpin.rzone.de
    Daily check
    Ended 2026-11-04 22:41 UTC
  52. microfoft.org US · AS29802 · HIVELOCITY, Inc.Lookalike of microsoft.com · a changed character
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microfoft.org
    Spelling
    Spelled like microsoft.com with a changed character
    First found
    2026-11-01 · the day we first found it in the .org zone file, already registered
    Registered
    2025-10-13 · NameCheap, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    64.238.34.20 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microfoft.org resolved to it 2026-11-05 00:46 UTC
    Addresses
    64.238.34.20 · United States · AS29802 HVC-AS - HIVELOCITY, Inc.
    MX
    mail.microfoft.org
    Daily check
    Ended 2026-11-04 22:41 UTC
  53. microdoft.info NL · AS49981 · WorldStream WorldStream B.V.2 addressesLookalike of microsoft.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listNamecheap
    DetailsHide
    Domain
    microdoft.info
    Spelling
    Spelled like microsoft.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2025-10-10 · NameCheap, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.59.170.20 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microdoft.info resolved to it 2026-11-04 18:09 UTC
    Addresses
    2.59.170.20 · Netherlands · AS49981 WorldStream WorldStream B.V.
    104.219.250.37 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (104.219.250.37): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  54. microsoftsupportcenter.digital AU · AS154653 · ParkLogic Pty LtdLookalike of microsoft.com · the name with an added word
    Subdomain reported by PhishDestroyParking page · ParkLogicMX present
    DetailsHide
    Domain
    microsoftsupportcenter.digital
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .digital zone file, already registered
    Registered
    2025-10-06 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Subdomain reported by PhishDestroy
    Reported by PhishDestroy · click5.microsoftsupportcenter.digital under microsoftsupportcenter.digital · in the feed since 2026-10-25 23:31 UTC
    Addresses
    162.4.84.247 · Australia · AS154653 PARKLOGICPTYLTD-AS-AP - ParkLogic Pty Ltd · ParkLogic (parking page)
    Parking page · ParkLogic
    The registry delegates microsoftsupportcenter.digital to ParkLogic’s nameservers, which answer for it. ParkLogic (162.4.84.247): a parking service. It answers for names that are typically for sale or unused.
    MX
    mail.eye-mail.net
    Daily check
    Ended 2026-11-04 22:41 UTC
  55. hotmil.org DE · AS8560 · IONOS-AS IONOS SE2 addressesLookalike of hotmail.com · a dropped letter
    Address on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    hotmil.org
    Spelling
    Spelled like hotmail.com with a dropped letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2025-08-30 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.160.0.128 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmil.org resolved to it 2026-11-04 16:24 UTC
    Addresses
    217.160.0.128 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    2001:8d8:100f:f000::200
    IONOS
    IONOS (217.160.0.128): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx00.ionos.fr
    mx01.ionos.fr
    Daily check
    Ended 2026-11-04 22:41 UTC
  56. onedtive.com NL · AS43350 · NFORCE NForce Entertainment…Lookalike of onedrive.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listRegistry lookup queuedMX present
    DetailsHide
    Domain
    onedtive.com
    Spelling
    Spelled like onedrive.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2025-08-26 · Media Elite Holdings Limited, S.A.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    77.247.182.251 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · onedtive.com resolved to it 2026-11-04 19:01 UTC
    Addresses
    77.247.182.251 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    MX
    mail.h-email.net
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  57. mlcrosoft365.online SK · AS51013 · WEBSUPPORT-SRO-SK-AS WebSup…Lookalike of microsoft365.com · similar-looking characters
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    mlcrosoft365.online
    Spelling
    Spelled like microsoft365.com with similar-looking characters
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2025-08-13 · Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    37.9.175.211 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · mlcrosoft365.online resolved to it 2026-11-04 18:09 UTC
    Addresses
    37.9.175.211 · Slovakia · AS51013 WEBSUPPORT-SRO-SK-AS WebSupport s.r.o.
    MX
    mail.mlcrosoft365.online
    Daily check
    Ended 2026-11-04 22:41 UTC
  58. microsotf.online SK · AS51013 · WEBSUPPORT-SRO-SK-AS WebSup…2 addressesLookalike of microsoft.com · two letters swapped
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsotf.online
    Spelling
    Spelled like microsoft.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2025-07-16 · Ascio Technologies, Inc. Danmark - Filial af Ascio technologies, Inc. USA
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    37.9.175.211 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsotf.online resolved to it 2026-11-04 18:09 UTC
    Addresses
    37.9.175.211 · Slovakia · AS51013 WEBSUPPORT-SRO-SK-AS WebSupport s.r.o.
    2a00:4b40:aaaa:2011::7
    MX
    mx10.active24.cz
    mx20.active24.cz
    Daily check
    Ended 2026-11-04 22:41 UTC
  59. microsoftonline.ai CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of microsoftonline.com · the ending .ai
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    microsoftonline.ai
    Spelling
    The name of microsoftonline.com with the ending .ai
    First found
    2026-10-31 · the day the daily DNS check first found it registered
    Registered
    2025-05-30 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoftonline.ai resolved to it 2026-11-05 05:20 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  60. hotmail.to NL · AS49981 · WorldStream WorldStream B.V.2 addressesLookalike of hotmail.com · the ending .to
    Address on DomainSpoof’s phishing-host listNamecheap
    DetailsHide
    Domain
    hotmail.to
    Spelling
    The name of hotmail.com with the ending .to
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Registered
    2025-03-10 · Tonic
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.59.170.20 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmail.to resolved to it 2026-11-01 13:15 UTC
    Addresses
    2.59.170.20 · Netherlands · AS49981 WorldStream WorldStream B.V.
    104.219.250.37 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (104.219.250.37): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  61. microsfot.us US · AS46475 · Limestone Networks, Inc.Lookalike of microsoft.com · two letters swapped
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsfot.us
    Spelling
    Spelled like microsoft.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2024-12-19 · CommuniGal Communication Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    216.245.197.44 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsfot.us resolved to it 2026-11-04 18:09 UTC
    Addresses
    216.245.197.44 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  62. mircosoft.us NL · AS43350 · NFORCE NForce Entertainment…Lookalike of microsoft.com · two letters swapped
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    mircosoft.us
    Spelling
    Spelled like microsoft.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2024-12-19 · CommuniGal Communication Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    77.247.179.82 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · mircosoft.us resolved to it 2026-11-04 18:09 UTC
    Addresses
    77.247.179.82 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    Daily check
    Ended 2026-11-04 22:41 UTC
  63. miccrosoft.online DE · AS8560 · IONOS-AS IONOS SE2 addressesLookalike of microsoft.com · a doubled letter
    Address on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    miccrosoft.online
    Spelling
    Spelled like microsoft.com with a doubled letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2024-09-19 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.160.0.89 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · miccrosoft.online resolved to it 2026-11-04 18:09 UTC
    Addresses
    217.160.0.89 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    2001:8d8:100f:f000::200
    IONOS
    IONOS (217.160.0.89): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx00.ionos.de
    mx01.ionos.de
    Daily check
    Ended 2026-11-04 22:41 UTC
  64. officem365.online CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of microsoft.com · an added character
    Address on DomainSpoof’s phishing-host listHostingerMX present
    DetailsHide
    Domain
    officem365.online
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2024-09-13 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · officem365.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    officem365-online.mail.protection.outlook.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  65. microsofts.software CY · AS47583 · AS-HOSTINGER Hostinger Inte…Lookalike of microsoft.com · an added character
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    microsofts.software
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .software zone file, already registered
    Registered
    2024-08-30 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsofts.software resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  66. hotmail.cam US · AS53667 · FranTech SolutionsLookalike of hotmail.com · the ending .cam
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    hotmail.cam
    Spelling
    The name of hotmail.com with the ending .cam
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Registered
    2024-04-29 · Dynadot Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    198.251.89.114 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmail.cam resolved to it 2026-11-01 13:15 UTC
    Addresses
    198.251.89.114 · United States · AS53667 PONYNET - FranTech Solutions
    MX
    mail.hotmail.cam
    Daily check
    Ended 2026-11-04 22:41 UTC
  67. microsott.fr FR · AS16276 · OVH OVH SAS2 addressesLookalike of microsoft.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listOVHMX present
    DetailsHide
    Domain
    microsott.fr
    Spelling
    Spelled like microsoft.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2024-01-19 · OVH
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    145.239.37.162 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsott.fr resolved to it 2026-11-04 18:09 UTC
    Addresses
    145.239.37.162 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    2001:41d0:301::30
    OVH
    OVH (145.239.37.162): a cloud provider. It rents servers and addresses to its customers.
    MX
    mx1.mail.ovh.net
    mx2.mail.ovh.net
    mx3.mail.ovh.net
    Daily check
    Ended 2026-11-04 22:41 UTC
  68. 0nedrive.cloud CZ · AS24806 · INTERNET-CZ INTERNET CZ, a.…Lookalike of onedrive.com · similar-looking characters
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    0nedrive.cloud
    Spelling
    Spelled like onedrive.com with similar-looking characters
    First found
    2026-11-01 · the day we first found it in the .cloud zone file, already registered
    Registered
    2023-11-28 · Tucows Domains Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    81.2.196.19 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · 0nedrive.cloud resolved to it 2026-11-05 00:46 UTC
    Addresses
    81.2.196.19 · Czechia · AS24806 INTERNET-CZ INTERNET CZ, a.s.
    Daily check
    Ended 2026-11-04 22:41 UTC
  69. mircosoft365.online DE · AS8560 · IONOS-AS IONOS SELookalike of microsoft365.com · two letters swapped
    Address on DomainSpoof’s phishing-host listIONOS
    DetailsHide
    Domain
    mircosoft365.online
    Spelling
    Spelled like microsoft365.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2023-10-17 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    213.171.195.105 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · mircosoft365.online resolved to it 2026-11-04 18:09 UTC
    Addresses
    213.171.195.105 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (213.171.195.105): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  70. micorsoftonline.com NL · AS43350 · NFORCE NForce Entertainment…Lookalike of microsoftonline.com · two letters swapped
    Address on DomainSpoof’s phishing-host listRegistry lookup queued
    DetailsHide
    Domain
    micorsoftonline.com
    Spelling
    Spelled like microsoftonline.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2023-08-04 · Travel Domains, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    77.247.179.88 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · micorsoftonline.com resolved to it 2026-11-04 18:10 UTC
    Addresses
    77.247.179.88 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  71. microsoft-teams-room-as-a-service.online NL · AS20857 · TRANSIP-AS Signet B.V.2 addressesLookalike of microsoft.com · the name with the word “teams-room-as-a-service”
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsoft-teams-room-as-a-service.online
    Spelling
    The name of microsoft.com with the word “teams-room-as-a-service”
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2023-07-20 · Key-Systems LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    37.97.254.27 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-teams-room-as-a-service.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    37.97.254.27 · Netherlands · AS20857 TRANSIP-AS Signet B.V.
    2a01:7c8:3:1337::27
    MX
    microsoft-teams-room-as-a-service.online
    Daily check
    Ended 2026-11-04 22:41 UTC
  72. microsoft-login.liveLookalike of microsoft.com · the name with the word “login”
    Listed by MetaMaskMX present
    DetailsHide
    Domain
    microsoft-login.live
    Spelling
    The name of microsoft.com with the word “login”
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2023-07-05 · OVH SAS
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-login.live · in the feed since 2026-10-27 05:34 UTC
    MX
    mx1.hostinger.com
    mx2.hostinger.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  73. microsoft-services.online DE · AS8560 · IONOS-AS IONOS SE2 addressesLookalike of microsoft.com · the name with the word “services”
    Address on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    microsoft-services.online
    Spelling
    The name of microsoft.com with the word “services”
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2023-06-14 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.160.0.62 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-services.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    217.160.0.62 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    2001:8d8:100f:f000::275
    IONOS
    IONOS (217.160.0.62): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx00.ionos.de
    mx01.ionos.de
    Daily check
    Ended 2026-11-04 22:41 UTC
  74. microsoft365.store AT · AS25575 · DOMAINTECHNIK Ledl.net GmbH…Lookalike of microsoft365.com · the ending .store
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsoft365.store
    Spelling
    The name of microsoft365.com with the ending .store
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2022-08-09 · Ledl.net GmbH & Co KG
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    213.145.228.16 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft365.store resolved to it 2026-11-04 18:09 UTC
    Addresses
    213.145.228.16 · Austria · AS25575 DOMAINTECHNIK Ledl.net GmbH & Co. KG
    MX
    mail.microsoft365.store
    Daily check
    Ended 2026-11-04 22:41 UTC
  75. icrosoft.org US · AS29802 · HIVELOCITY, Inc.Lookalike of microsoft.com · a dropped letter
    Subdomain reported by PhishDestroyAddress on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    icrosoft.org
    Spelling
    Spelled like microsoft.com with a dropped letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2022-05-24 · NameCheap, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Subdomain reported by PhishDestroy
    Reported by PhishDestroy · m.icrosoft.org under icrosoft.org · in the feed since 2026-10-25 23:31 UTC
    Address on DomainSpoof’s phishing-host list
    64.238.34.20 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · icrosoft.org resolved to it 2026-11-04 18:09 UTC
    Addresses
    64.238.34.20 · United States · AS29802 HVC-AS - HIVELOCITY, Inc.
    MX
    mail.icrosoft.org
    Daily check
    Ended 2026-11-04 22:41 UTC
  76. ms-office.store RU · AS25532 · MASTERHOST-AS LLC "MASTERHO…8 addressesLookalike of microsoft.com · an added hyphen
    Address on DomainSpoof’s phishing-host listRegistry lookup queuedMX present
    DetailsHide
    Domain
    ms-office.store
    Spelling
    Spelled like microsoft.com with an added hyphen
    First found
    2026-11-01 · the day we first found it in the .store zone file, already registered
    Registered
    2021-10-29 · Registrator Domenov LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    90.156.201.97 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · ms-office.store resolved to it 2026-11-05 00:46 UTC
    Addresses
    90.156.201.30 · Russia · AS25532 MASTERHOST-AS LLC "MASTERHOST"
    90.156.201.47 · Russia · AS25532 MASTERHOST-AS LLC "MASTERHOST"
    90.156.201.87 · Russia · AS25532 MASTERHOST-AS LLC "MASTERHOST"
    90.156.201.97 · Russia · AS25532 MASTERHOST-AS LLC "MASTERHOST"
    2a00:15f8:a000:5:1:11:7:e97c
    2a00:15f8:a000:5:1:12:7:e97c
    2a00:15f8:a000:5:1:13:7:e97c
    2a00:15f8:a000:5:1:14:7:e97c
    MX
    mx1.masterhost.ru
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  77. icrosoft.info US · AS35985 · One Ring Networks, Inc.Lookalike of microsoft.com · a dropped letter
    Address on DomainSpoof’s phishing-host listRegistry lookup queuedMX present
    DetailsHide
    Domain
    icrosoft.info
    Spelling
    Spelled like microsoft.com with a dropped letter
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2021-08-26 · GoDaddy.com, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    64.191.166.205 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · icrosoft.info resolved to it 2026-11-04 18:09 UTC
    Addresses
    64.191.166.205 · United States · AS35985 ONERINGNET-ATL-1 - One Ring Networks, Inc.
    MX
    mail.icrosoft.info
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  78. microsoft635.com NL · AS43350 · NFORCE NForce Entertainment…Lookalike of microsoft365.com · two letters swapped
    Address on DomainSpoof’s phishing-host listRegistry lookup queuedMX present
    DetailsHide
    Domain
    microsoft635.com
    Spelling
    Spelled like microsoft365.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2021-05-17 · Media Elite Holdings Limited, S.A.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    77.247.182.251 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft635.com resolved to it 2026-11-04 18:09 UTC
    Addresses
    77.247.182.251 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    MX
    mail.h-email.net
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  79. offiec365.com US · AS46475 · Limestone Networks, Inc.Lookalike of office365.com · two letters swapped
    Address on DomainSpoof’s phishing-host listRegistry lookup queuedMX present
    DetailsHide
    Domain
    offiec365.com
    Spelling
    Spelled like office365.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2021-02-09 · Media Elite Holdings Limited, S.A.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    216.245.213.77 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · offiec365.com resolved to it 2026-11-04 18:57 UTC
    Addresses
    216.245.213.77 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    MX
    mail.h-email.net
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  80. microsoftonline.cm NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…Lookalike of microsoftonline.com · the ending .cm
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoftonline.cm
    Spelling
    The name of microsoftonline.com with the ending .cm
    First found
    2026-10-31 · the day the daily DNS check first found it registered
    Registered
    2020-10-25 · Netcom.cm Sarl
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    212.7.194.68 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoftonline.cm resolved to it 2026-11-05 05:20 UTC
    Addresses
    212.7.194.68 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Daily check
    Ended 2026-11-04 22:41 UTC
  81. office365.to NL · AS49981 · WorldStream WorldStream B.V.2 addressesLookalike of office365.com · the ending .to
    Address on DomainSpoof’s phishing-host listNamecheap
    DetailsHide
    Domain
    office365.to
    Spelling
    The name of office365.com with the ending .to
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Registered
    2020-07-30 · Tonic
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.59.170.20 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · office365.to resolved to it 2026-11-01 21:04 UTC
    Addresses
    2.59.170.20 · Netherlands · AS49981 WorldStream WorldStream B.V.
    104.219.250.37 · United States · AS22612 NAMECHEAP-NET - Namecheap, Inc. · Namecheap (shared hosting)
    Namecheap
    Namecheap (104.219.250.37): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  82. microsoft356.org DE · AS48596 · INWX InterNetworX Managemen…Lookalike of microsoft365.com · two letters swapped
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoft356.org
    Spelling
    Spelled like microsoft365.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2020-03-12 · INWX GmbH
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    185.181.104.242 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft356.org resolved to it 2026-11-04 18:09 UTC
    Addresses
    185.181.104.242 · Germany · AS48596 INWX InterNetworX Management GmbH
    Daily check
    Ended 2026-11-04 22:41 UTC
  83. microsofltonline.org US · AS14618 · Amazon.com, Inc.2 addressesLookalike of microsoft.com · an added character
    Subdomain reported by PhishDestroyAmazon Web ServicesMX present
    DetailsHide
    Domain
    microsofltonline.org
    Spelling
    Spelled like microsoft.com with an added character
    First found
    2026-11-01 · the day we first found it in the .org zone file, already registered
    Registered
    2019-12-12 · Amazon Registrar, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Subdomain reported by PhishDestroy
    Reported by PhishDestroy · login.microsofltonline.org under microsofltonline.org · in the feed since 2026-11-03 21:22 UTC
    Addresses
    3.216.85.130 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    44.197.109.126 · United States · AS14618 AMAZON-AES - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (3.216.85.130, 44.197.109.126): a cloud provider. It rents servers and addresses to its customers.
    MX
    inbound-smtp.us-west-2.amazonaws.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  84. officd365.com NL · AS43350 · NFORCE NForce Entertainment…Lookalike of office365.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listRegistry lookup queued
    DetailsHide
    Domain
    officd365.com
    Spelling
    Spelled like office365.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2019-02-04 · Media Elite Holdings Limited, S.A.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    77.247.182.244 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · officd365.com resolved to it 2026-11-04 18:57 UTC
    Addresses
    77.247.182.244 · Netherlands · AS43350 NFORCE NForce Entertainment B.V.
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  85. hotmail.global US · AS25773 · RADWARE INC.Lookalike of hotmail.com · the ending .global
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    hotmail.global
    Spelling
    The name of hotmail.com with the ending .global
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Registered
    2019-01-03 · eNom, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    66.22.16.138 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmail.global resolved to it 2026-11-01 13:15 UTC
    Addresses
    66.22.16.138 · United States · AS25773 RADWARE-CLOUD-SERVICES - RADWARE INC.
    Daily check
    Ended 2026-11-04 22:41 UTC
  86. office365.uk GB · AS8622 · ISIONUK TEAM BLUE INTERNET …Lookalike of office365.com · the ending .uk
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    office365.uk
    Spelling
    The name of office365.com with the ending .uk
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Registered
    2018-12-12 · Team Blue Internet Services UK Limited t/a Team Blue Internet Services Limited t/a LCN
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    85.233.160.22 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · office365.uk resolved to it 2026-11-01 21:04 UTC
    Addresses
    85.233.160.22 · United Kingdom · AS8622 ISIONUK TEAM BLUE INTERNET SERVICES UK LIMITED
    MX
    mailforward.lcn.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  87. onecrive.com NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…Lookalike of onedrive.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listRegistry lookup queued
    DetailsHide
    Domain
    onecrive.com
    Spelling
    Spelled like onedrive.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2018-11-16 · Media Elite Holdings Limited, S.A.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    213.227.156.75 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · onecrive.com resolved to it 2026-11-04 19:01 UTC
    Addresses
    213.227.156.75 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  88. officr365.com NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…Lookalike of office365.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listRegistry lookup queued
    DetailsHide
    Domain
    officr365.com
    Spelling
    Spelled like office365.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2018-07-30 · Media Elite Holdings Limited, S.A.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    37.48.110.47 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · officr365.com resolved to it 2026-11-04 18:57 UTC
    Addresses
    37.48.110.47 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  89. ofifce365.com US · AS46475 · Limestone Networks, Inc.Lookalike of office365.com · two letters swapped
    Address on DomainSpoof’s phishing-host listRegistry lookup queued
    DetailsHide
    Domain
    ofifce365.com
    Spelling
    Spelled like office365.com with two letters swapped
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2018-04-04 · Media Elite Holdings Limited, S.A.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    216.245.213.76 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · ofifce365.com resolved to it 2026-11-04 18:57 UTC
    Addresses
    216.245.213.76 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  90. microsoft365.blog DE · AS6724 · STRATO Strato GmbH2 addressesLookalike of microsoft365.com · the ending .blog
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsoft365.blog
    Spelling
    The name of microsoft365.com with the ending .blog
    First found
    2026-10-31 · the day the daily DNS check first found it registered
    Registered
    2017-07-13 · Cronon GmbH
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    81.169.145.150 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft365.blog resolved to it 2026-11-05 05:18 UTC
    Addresses
    81.169.145.150 · Germany · AS6724 STRATO Strato GmbH
    2a01:238:20a:202:1150::
    MX
    smtpin.rzone.de
    Daily check
    Ended 2026-11-04 22:41 UTC
  91. microsoft365.shop DE · AS6724 · STRATO Strato GmbH2 addressesLookalike of microsoft365.com · the ending .shop
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsoft365.shop
    Spelling
    The name of microsoft365.com with the ending .shop
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2017-07-13 · CRONON GmbH
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    81.169.145.150 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft365.shop resolved to it 2026-11-04 18:09 UTC
    Addresses
    81.169.145.150 · Germany · AS6724 STRATO Strato GmbH
    2a01:238:20a:202:1150::
    MX
    smtpin.rzone.de
    Daily check
    Ended 2026-11-04 22:41 UTC
  92. microsoft365.uk DE · AS8560 · IONOS-AS IONOS SE2 addressesLookalike of microsoft365.com · the ending .uk
    Address on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    microsoft365.uk
    Spelling
    The name of microsoft365.com with the ending .uk
    First found
    2026-10-31 · the day the daily DNS check first found it registered
    Registered
    2017-07-11 · Ionos SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.160.0.98 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft365.uk resolved to it 2026-11-05 05:18 UTC
    Addresses
    217.160.0.98 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    2001:8d8:100f:f000::200
    IONOS
    IONOS (217.160.0.98): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx00.ionos.co.uk
    mx01.ionos.co.uk
    Daily check
    Ended 2026-11-04 22:41 UTC
  93. office365support.london DE · AS8560 · IONOS-AS IONOS SELookalike of microsoft.com · the name with an added word
    Address on DomainSpoof’s phishing-host listIONOS
    DetailsHide
    Domain
    office365support.london
    Spelling
    The name of microsoft.com with an added word
    First found
    2026-11-01 · the day we first found it in the .london zone file, already registered
    Registered
    2014-08-27 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    213.171.195.105 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · office365support.london resolved to it 2026-11-05 00:46 UTC
    Addresses
    213.171.195.105 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (213.171.195.105): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  94. microsoft365.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …Lookalike of microsoft365.com · the ending .pl
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsoft365.pl
    Spelling
    The name of microsoft365.com with the ending .pl
    First found
    2026-10-31 · the day the daily DNS check first found it registered
    Registered
    2012-06-27 · Aftermarket.pl Limited
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    185.253.212.22 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft365.pl resolved to it 2026-11-05 05:18 UTC
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    MX
    blackhole.aftermarket.pl
    Daily check
    Ended 2026-11-04 22:41 UTC
  95. hotmwil.com US · AS46475 · Limestone Networks, Inc.Lookalike of hotmail.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listRegistry lookup queued
    DetailsHide
    Domain
    hotmwil.com
    Spelling
    Spelled like hotmail.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2003-10-31 · eNom, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    69.162.80.55 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmwil.com resolved to it 2026-11-04 16:24 UTC
    Addresses
    69.162.80.55 · United States · AS46475 LIMESTONENETWORKS - Limestone Networks, Inc.
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  96. xn--microsft-03a.com DE · AS8560 · IONOS-AS IONOS SELookalike of microsoft.com · international characters, shown as microsóft.com
    Address on DomainSpoof’s phishing-host listIONOS
    DetailsHide
    Domain
    xn--microsft-03a.com
    Spelling
    Spelled like microsoft.com with international characters, shown as microsóft.com
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2001-02-26 · Arsys Internet, S.L. dba NICLINE.COM
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.76.128.34 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · xn--microsft-03a.com resolved to it 2026-11-04 18:09 UTC
    Addresses
    217.76.128.34 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (217.76.128.34): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  97. midrosoft.net DE · AS8560 · IONOS-AS IONOS SE2 addressesLookalike of microsoft.com · a letter from a neighbouring key
    Address on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    midrosoft.net
    Spelling
    Spelled like microsoft.com with a letter from a neighbouring key
    First found
    2026-10-26 · the day the daily DNS check first found it registered
    Registered
    2001-01-31 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.160.0.124 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · midrosoft.net resolved to it 2026-11-04 18:09 UTC
    Addresses
    217.160.0.124 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    2001:8d8:100f:f000::200
    IONOS
    IONOS (217.160.0.124): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx00.ionos.de
    mx01.ionos.de
    Daily check
    Ended 2026-11-04 22:41 UTC
  98. outlook.tc US · AS965 · Webhosting Holdings LLCLookalike of outlook.com · the ending .tc
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    outlook.tc
    Spelling
    The name of outlook.com with the ending .tc
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    193.108.130.23 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · outlook.tc resolved to it 2026-11-01 22:00 UTC
    Addresses
    193.108.130.23 · United States · AS965 WEBHOSTINGHOLDINGS - Webhosting Holdings LLC
    MX
    mx1.mxfilter.net
    mx2.mxfilter.net
    mx3.mxfilter.net
    mx4.mxfilter.net
    Daily check
    Ended 2026-11-04 22:41 UTC
  99. onedrive.md FR · AS24935 · ATE-AS Eurofiber France SASLookalike of onedrive.com · the ending .md
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    onedrive.md
    Spelling
    The name of onedrive.com with the ending .md
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    185.26.106.234 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · onedrive.md resolved to it 2026-11-01 21:21 UTC
    Addresses
    185.26.106.234 · France · AS24935 ATE-AS Eurofiber France SAS
    MX
    mx1.netim.net
    mx2.netim.net
    Daily check
    Ended 2026-11-04 22:41 UTC
  100. office365.co.jp JP · AS7506 · GMO Internet, Inc.Lookalike of office365.com · the ending .co.jp
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    office365.co.jp
    Spelling
    The name of office365.com with the ending .co.jp
    First found
    2026-11-01 · the day the daily DNS check first found it registered
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · office365.co.jp resolved to it 2026-11-01 21:04 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC

Registered domains using the name

Domains from registry zone files (ICANN CZDS), checked daily like the lookalikes above. Each row says how it matches Microsoft's names. Resellers, fans and other businesses register names like these too. Our zone data terms apply to them.

100 of 808 shown: listed ones first, then the newest registrations.

  1. sharepoint365.support KN · AS402253 · SKN Subnet & Telecom LtdContains “sharepoint”
    Address on Spamhaus DROP
    DetailsHide
    Domain
    sharepoint365.support
    Match
    A new registration containing “sharepoint”, one of the names we match for Microsoft
    First found
    2026-11-05 · the day the .support zone file first listed it as a new registration
    Registered
    2026-11-04 · Spaceship, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on Spamhaus DROP
    104.251.180.138 is on Spamhaus DROP · sharepoint365.support resolved to it 2026-11-05 05:11 UTC
    Addresses
    104.251.180.138 · St. Kitts & Nevis · AS402253 SKN-NETWORK-1 - SKN Subnet & Telecom Ltd
    Daily check
    Ended 2026-11-04 22:41 UTC
  2. cdn-microsoft.top SG · AS63949 · Akamai Connected Cloud3 addressesContains “microsoft”
    2 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    cdn-microsoft.top
    Match
    A new registration containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-05 · the day the .top zone file first listed it as a new registration
    Registered
    2026-11-04 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    2 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (cdn-microsoft.top resolved to it 2026-11-05 04:17 UTC), 172.232.24.235 (cdn-microsoft.top resolved to it 2026-11-05 04:17 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    45.79.154.26 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (45.79.154.26, 172.232.24.161, 172.232.24.235): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  3. microsoftoffice365.top SG · AS63949 · Akamai Connected Cloud3 addressesContains “microsoft”
    Listed by MetaMask3 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    microsoftoffice365.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-10-30 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftoffice365.top · in the feed since 2026-11-01 11:44 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (microsoftoffice365.top resolved to it 2026-11-05 00:46 UTC), 172.232.24.235 (microsoftoffice365.top resolved to it 2026-11-05 00:46 UTC), 172.234.25.42 (microsoftoffice365.top resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  4. onedrive-sync.top SG · AS63949 · Akamai Connected Cloud3 addressesContains “onedrive”
    3 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    onedrive-sync.top
    Match
    A domain containing “onedrive”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-10-29 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (onedrive-sync.top resolved to it 2026-11-05 00:46 UTC), 172.232.24.235 (onedrive-sync.top resolved to it 2026-11-05 00:46 UTC), 172.234.25.42 (onedrive-sync.top resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  5. microsoftsupp.info RU · AS209207 · DHOST-AS Digital Hosting Pr…Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    microsoftsupp.info
    Match
    A registered domain containing “microsoft”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .info zone file copy it was found in
    Registered
    2026-10-22 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    168.113.215.244 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoftsupp.info resolved to it 2026-11-05 00:46 UTC
    Addresses
    168.113.215.244 · Russia · AS209207 DHOST-AS Digital Hosting Provider LLC
    Daily check
    Ended 2026-11-04 22:41 UTC
  6. microsoft-office.topContains “microsoft”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoft-office.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-10-18 · West263 International Limited
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-office.top · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  7. microsoftsharefile.topContains “microsoft”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoftsharefile.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-10-18 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftsharefile.top · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  8. microsoftsharefile1.topContains “microsoft”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoftsharefile1.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-10-18 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftsharefile1.top · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  9. microsoftes.liveContains “microsoft”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoftes.live
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-10-06 · Dynadot Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftes.live · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  10. microsoft-teams.sbs US · AS13335 · Cloudflare, Inc.4 addressesContains “microsoft”
    Listed by MetaMaskCloudflare
    DetailsHide
    Domain
    microsoft-teams.sbs
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .sbs zone file, already registered
    Registered
    2026-10-03 · Dynadot Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-teams.sbs · in the feed since 2026-10-27 05:34 UTC
    Addresses
    104.21.32.178 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.153.49 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3036::ac43:9931
    2606:4700:3037::6815:20b2
    Cloudflare
    Cloudflare (104.21.32.178, 172.67.153.49): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Daily check
    Ended 2026-11-04 22:41 UTC
  11. microsoft-office365.site US · AS13335 · Cloudflare, Inc.4 addressesContains “microsoft”
    Listed by MetaMaskReported by PhishDestroyCloudflareMX present
    DetailsHide
    Domain
    microsoft-office365.site
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .site zone file, already registered
    Registered
    2026-09-26 · Cloudflare, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-office365.site · in the feed since 2026-10-27 05:34 UTC
    Reported by PhishDestroy
    Reported by PhishDestroy · microsoft-office365.site · in the feed since 2026-10-25 23:31 UTC
    Addresses
    104.21.16.197 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.215.149 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::ac43:d795
    2606:4700:3035::6815:10c5
    Cloudflare
    Cloudflare (104.21.16.197, 172.67.215.149): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    MX
    mx01.mail.icloud.com
    mx02.mail.icloud.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  12. microsoft-onedrive.org SG · AS63949 · Akamai Connected CloudContains “microsoft”
    Listed by MetaMaskAkamai Linode
    DetailsHide
    Domain
    microsoft-onedrive.org
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .org zone file, already registered
    Registered
    2026-09-25 · Squarespace Domains LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-onedrive.org · in the feed since 2026-10-27 05:34 UTC
    Addresses
    74.207.228.73 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (74.207.228.73): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  13. microsoft-edge.download IS · AS50613 · ThorDC-AS Advania Island ehfContains “microsoft”
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    microsoft-edge.download
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .download zone file, already registered
    Registered
    2026-09-23 · TLD Registrar Solutions Ltd.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    82.221.136.24 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-edge.download resolved to it 2026-11-05 00:46 UTC
    Addresses
    82.221.136.24 · Iceland · AS50613 ThorDC-AS Advania Island ehf
    MX
    mx1.sf.ice-networks.com
    mx2.sf.ice-networks.com
    mx3.sf.ice-networks.com
    mx4.sf.ice-networks.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  14. office-365.shop DE · AS8560 · IONOS-AS IONOS SE2 addressesContains “office-365”
    Address on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    office-365.shop
    Match
    A registered domain containing “office-365”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .shop zone file copy it was found in
    Registered
    2026-09-22 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.160.0.115 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · office-365.shop resolved to it 2026-11-05 00:46 UTC
    Addresses
    217.160.0.115 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    2001:8d8:100f:f000::200
    IONOS
    IONOS (217.160.0.115): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mail.protonmail.ch
    mailsec.protonmail.ch
    Daily check
    Ended 2026-11-04 22:41 UTC
  15. microsoft-teams.sarlContains “microsoft”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoft-teams.sarl
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .sarl zone file, already registered
    Registered
    2026-09-19 · Cloudflare, Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-teams.sarl · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  16. microsoft-meet.live PA · AS64107 · RACK SPHERE HOSTING S.A.Contains “microsoft”
    Listed by MetaMask
    DetailsHide
    Domain
    microsoft-meet.live
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-09-15 · NICENIC INTERNATIONAL GROUP CO., LIMITED
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-meet.live · in the feed since 2026-10-27 05:34 UTC
    Addresses
    45.225.135.67 · Panama · AS64107 AS64107 - RACK SPHERE HOSTING S.A.
    Daily check
    Ended 2026-11-04 22:41 UTC
  17. microsoft-cedar-technologies.click SG · AS63949 · Akamai Connected Cloud3 addressesContains “microsoft”
    3 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    microsoft-cedar-technologies.click
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .click zone file, already registered
    Registered
    2026-08-21 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (microsoft-cedar-technologies.click resolved to it 2026-11-05 00:46 UTC), 172.232.24.235 (microsoft-cedar-technologies.click resolved to it 2026-11-05 00:46 UTC), 172.234.25.42 (microsoft-cedar-technologies.click resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  18. com-onedrive.live US · AS13335 · Cloudflare, Inc.4 addressesContains “onedrive”
    Listed by MetaMaskCloudflare
    DetailsHide
    Domain
    com-onedrive.live
    Match
    A domain containing “onedrive”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-08-16 · Cloudflare, Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · com-onedrive.live · in the feed since 2026-10-27 05:34 UTC
    Addresses
    104.21.33.172 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.165.13 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3034::6815:21ac
    2606:4700:3036::ac43:a50d
    Cloudflare
    Cloudflare (104.21.33.172, 172.67.165.13): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Daily check
    Ended 2026-11-04 22:41 UTC
  19. microsoft3.sbsContains “microsoft”
    Listed by MetaMaskNo address or mail server yet
    DetailsHide
    Domain
    microsoft3.sbs
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .sbs zone file, already registered
    Registered
    2026-08-07 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft3.sbs · in the feed since 2026-10-27 05:34 UTC
    No address or mail server yet
    Registered; the daily DNS check has found no address (A, AAAA) or mail server (MX) for the domain so far. The label goes when it gets one.
    Daily check
    Ended 2026-11-04 22:41 UTC
  20. microsoftonline-sharepoint-com.live US · AS13335 · Cloudflare, Inc.4 addressesContains “microsoftonline”
    Listed by MetaMaskCloudflare
    DetailsHide
    Domain
    microsoftonline-sharepoint-com.live
    Match
    A domain containing “microsoftonline”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-08-07 · Cloudflare, Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftonline-sharepoint-com.live · in the feed since 2026-10-27 05:34 UTC
    Addresses
    104.21.51.191 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.184.169 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3031::6815:33bf
    2606:4700:3032::ac43:b8a9
    Cloudflare
    Cloudflare (104.21.51.191, 172.67.184.169): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Daily check
    Ended 2026-11-04 22:41 UTC
  21. microsoftonline-sharepoint.online US · AS14061 · DigitalOcean, LLCContains “microsoftonline”
    Listed by MetaMaskDigitalOcean
    DetailsHide
    Domain
    microsoftonline-sharepoint.online
    Match
    A domain containing “microsoftonline”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2026-07-27 · Cloudflare, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftonline-sharepoint.online · in the feed since 2026-10-27 05:34 UTC
    Addresses
    178.62.99.223 · United States · AS14061 DIGITALOCEAN-ASN - DigitalOcean, LLC · DigitalOcean (cloud provider)
    DigitalOcean
    DigitalOcean (178.62.99.223): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  22. office365microsoft.help SG · AS63949 · Akamai Connected Cloud3 addressesContains “microsoft”
    3 addresses on DomainSpoof’s phishing-host listAkamai LinodeMX present
    DetailsHide
    Domain
    office365microsoft.help
    Match
    A registered domain containing “microsoft”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .help zone file copy it was found in
    Registered
    2026-07-26 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (office365microsoft.help resolved to it 2026-11-05 00:46 UTC), 172.232.24.235 (office365microsoft.help resolved to it 2026-11-05 00:46 UTC), 172.234.25.42 (office365microsoft.help resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    MX
    mx1.titan.email
    mx2.titan.email
    Daily check
    Ended 2026-11-04 22:41 UTC
  23. msoffice.email CY · AS47583 · AS-HOSTINGER Hostinger Inte…Contains “msoffice”
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    msoffice.email
    Match
    A domain containing “msoffice”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .email zone file, already registered
    Registered
    2026-07-24 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · msoffice.email resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  24. msoffice.live CY · AS47583 · AS-HOSTINGER Hostinger Inte…Contains “msoffice”
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    msoffice.live
    Match
    A registered domain containing “msoffice”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .live zone file copy it was found in
    Registered
    2026-07-24 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · msoffice.live resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  25. microsoftonline-outlook.live US · AS13335 · Cloudflare, Inc.4 addressesContains “microsoftonline”
    Listed by MetaMaskCloudflare
    DetailsHide
    Domain
    microsoftonline-outlook.live
    Match
    A domain containing “microsoftonline”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-07-17 · Cloudflare, Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftonline-outlook.live · in the feed since 2026-10-27 05:34 UTC
    Addresses
    104.21.24.65 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.217.82 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3030::6815:1841
    2606:4700:3031::ac43:d952
    Cloudflare
    Cloudflare (104.21.24.65, 172.67.217.82): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Daily check
    Ended 2026-11-04 22:41 UTC
  26. onmicrosoftfolder.sbs SG · AS63949 · Akamai Connected Cloud3 addressesContains “microsoft”
    3 addresses on DomainSpoof’s phishing-host listAkamai Linode
    DetailsHide
    Domain
    onmicrosoftfolder.sbs
    Match
    A registered domain containing “microsoft”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .sbs zone file copy it was found in
    Registered
    2026-07-08 · NameSilo, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    3 addresses on DomainSpoof’s phishing-host list
    172.232.24.161 (onmicrosoftfolder.sbs resolved to it 2026-11-05 00:46 UTC), 172.232.24.235 (onmicrosoftfolder.sbs resolved to it 2026-11-05 00:46 UTC), 172.234.25.42 (onmicrosoftfolder.sbs resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    172.232.24.161 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.232.24.235 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    172.234.25.42 · Singapore · AS63949 AKAMAI-LINODE-AP - Akamai Connected Cloud · Akamai Linode (cloud provider)
    Akamai Linode
    Akamai Linode (172.232.24.161, 172.232.24.235, 172.234.25.42): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  27. microsoftprada.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoftprada.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-07-04 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoftprada.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  28. microsoftcisco.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoftcisco.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-07-02 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoftcisco.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  29. microsoftinstagram.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoftinstagram.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-07-02 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoftinstagram.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  30. microsofttencent.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsofttencent.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-07-02 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsofttencent.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  31. hsbc-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    hsbc-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hsbc-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  32. ibm-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    ibm-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · ibm-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  33. microsoft-bmw.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-bmw.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-bmw.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  34. microsoft-fedex.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-fedex.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-fedex.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  35. microsoft-nintendo.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-nintendo.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-nintendo.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  36. microsoft-puma.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-puma.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-puma.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  37. microsoft-sap.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-sap.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-sap.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  38. microsoft-target.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-target.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-target.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  39. microsoft-volkswagen.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-volkswagen.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-volkswagen.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  40. nintendo-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    nintendo-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-29 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · nintendo-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  41. cisco-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    cisco-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · cisco-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  42. hermes-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    hermes-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hermes-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  43. kia-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    kia-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · kia-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  44. microsoft-amazon.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-amazon.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-amazon.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  45. microsoft-hyundai.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-hyundai.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-hyundai.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  46. microsoft-nescafe.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-nescafe.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-nescafe.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  47. microsoft-pepsi.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-pepsi.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-pepsi.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  48. microsoft-starbucks.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-starbucks.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-starbucks.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  49. microsoft-zara.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-zara.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-zara.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  50. paypal-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    paypal-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · paypal-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  51. prada-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    prada-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-28 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · prada-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  52. gillette-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    gillette-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-27 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · gillette-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  53. microsoft-netflix.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    microsoft-netflix.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-27 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-netflix.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  54. tencent-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    tencent-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-27 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · tencent-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  55. totalenergies-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    totalenergies-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-27 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · totalenergies-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  56. sap-microsoft.xyz DE · AS24940 · HETZNER-AS Hetzner Online G…Contains “microsoft”
    Address on DomainSpoof’s phishing-host listHetzner
    DetailsHide
    Domain
    sap-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2026-06-26 · NicNames, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    135.181.41.169 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · sap-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    135.181.41.169 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    Hetzner
    Hetzner (135.181.41.169): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  57. sharepoint.tips DE · AS212317 · HETZNER-CLOUD3-AS Hetzner O…14 addressesContains “sharepoint”
    5 addresses on DomainSpoof’s phishing-host listHetzner +1
    DetailsHide
    Domain
    sharepoint.tips
    Match
    A domain containing “sharepoint”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .tips zone file, already registered
    Registered
    2026-06-15 · Domain Science Kutatási Szolgáltató Korlátolt Felelősségű Társaság
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    5 addresses on DomainSpoof’s phishing-host list
    195.201.128.179 (sharepoint.tips resolved to it 2026-11-05 00:46 UTC), 46.62.237.138 (sharepoint.tips resolved to it 2026-11-05 00:46 UTC), 5.161.230.87 (sharepoint.tips resolved to it 2026-11-05 00:46 UTC), 5.161.47.86 (sharepoint.tips resolved to it 2026-11-05 00:46 UTC), 5.78.156.59 (sharepoint.tips resolved to it 2026-11-05 00:46 UTC) are on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours
    Addresses
    5.78.156.59 · Germany · AS212317 HETZNER-CLOUD3-AS Hetzner Online GmbH
    5.161.47.86 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    5.161.230.87 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH
    46.62.237.138 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    76.223.91.20 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    195.201.128.179 · Germany · AS24940 HETZNER-AS Hetzner Online GmbH · Hetzner (cloud provider)
    2406:da1e:214:c901:49:871:e9e1:eb92
    2600:1f1c:6db:8801:ca20:5f5a:5f45:48d0
    2a05:d014:179b:c400:b5e:feaf:a6dc:b508
    2a05:d014:179b:c400:2dc9:16fd:7cbd:e255
    2a05:d014:179b:c400:5ed8:1db0:4443:ca25
    2a05:d014:179b:c400:a327:40ee:24cc:6180
    2a05:d014:179b:c400:aa99:a226:6c94:e72
    2a05:d014:179b:c400:adda:f567:8e83:5e24
    Hetzner +1
    Hetzner (46.62.237.138, 195.201.128.179): a cloud provider. It rents servers and addresses to its customers. Amazon Web Services (76.223.91.20): a cloud provider. It rents servers and addresses to its customers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  58. microsoft-ai-claude.top DE · AS47846 · SEDO-AS SEDO GmbHContains “microsoft”
    Listed by MetaMaskParking page · Sedo
    DetailsHide
    Domain
    microsoft-ai-claude.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-05-29 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-ai-claude.top · in the feed since 2026-10-27 05:34 UTC
    Addresses
    91.195.240.123 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.123): a parking service. It answers for names that are typically for sale or unused.
    Daily check
    Ended 2026-11-04 22:41 UTC
  59. microsoft-google.top DE · AS47846 · SEDO-AS SEDO GmbHContains “microsoft”
    Listed by MetaMaskParking page · Sedo
    DetailsHide
    Domain
    microsoft-google.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-05-29 · NameSilo,LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoft-google.top · in the feed since 2026-10-27 05:34 UTC
    Addresses
    91.195.240.123 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.123): a parking service. It answers for names that are typically for sale or unused.
    Daily check
    Ended 2026-11-04 22:41 UTC
  60. microsoftcom.live US · AS16509 · Amazon.com, Inc.2 addressesContains “microsoft”
    Listed by MetaMaskReported by PhishDestroyRegistry lookup queuedAmazon Web Services
    DetailsHide
    Domain
    microsoftcom.live
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-05-29 · GoDaddy.com, LLC
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Listed by MetaMask
    Listed by MetaMask · microsoftcom.live · in the feed since 2026-10-27 05:34 UTC
    Reported by PhishDestroy
    Reported by PhishDestroy · microsoftcom.live · in the feed since 2026-10-25 23:31 UTC
    Addresses
    13.248.243.5 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    76.223.105.230 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (13.248.243.5, 76.223.105.230): a cloud provider. It rents servers and addresses to its customers.
    Registry lookup queued
    Listed on our completed DNS and web checks. The registry lookup (RDAP) that shows who holds the domain runs next. The label goes when it answers.
    Daily check
    Ended 2026-11-04 22:41 UTC
  61. evaservi-hotmail.online DE · AS8560 · IONOS-AS IONOS SEContains “hotmail”
    Address on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    evaservi-hotmail.online
    Match
    A domain containing “hotmail”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2026-05-24 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    217.76.128.47 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · evaservi-hotmail.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    217.76.128.47 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    IONOS
    IONOS (217.76.128.47): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx.serviciodecorreo.es
    Daily check
    Ended 2026-11-04 22:41 UTC
  62. outlook-mail.site CY · AS47583 · AS-HOSTINGER Hostinger Inte…Contains “outlook”
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    outlook-mail.site
    Match
    A registered domain containing “outlook”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .site zone file copy it was found in
    Registered
    2026-04-24 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · outlook-mail.site resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  63. entra-id-platform.online JP · AS7506 · GMO Internet, Inc.Contains “entra-id”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    entra-id-platform.online
    Match
    A domain containing “entra-id”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .online zone file, already registered
    Registered
    2026-04-19 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · entra-id-platform.online resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  64. azure-microsoft.top JP · AS9370 · SAKURA Internet Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    azure-microsoft.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-04-09 · GMO Internet, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    160.16.200.77 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · azure-microsoft.top resolved to it 2026-11-05 00:46 UTC
    Addresses
    160.16.200.77 · Japan · AS9370 SAKURA-B - SAKURA Internet Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  65. team-microsoft.top JP · AS9370 · SAKURA Internet Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    team-microsoft.top
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-03 · the day we first found it in the .top zone file, already registered
    Registered
    2026-04-09 · GMO Internet, Inc.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    160.16.200.77 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · team-microsoft.top resolved to it 2026-11-05 00:46 UTC
    Addresses
    160.16.200.77 · Japan · AS9370 SAKURA-B - SAKURA Internet Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  66. microsoft-office365.cloud DE · AS8560 · IONOS-AS IONOS SE2 addressesContains “microsoft”
    Reported by PhishDestroyAddress on DomainSpoof’s phishing-host listIONOSMX present
    DetailsHide
    Domain
    microsoft-office365.cloud
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .cloud zone file, already registered
    Registered
    2026-03-18 · IONOS SE
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Reported by PhishDestroy
    Reported by PhishDestroy · microsoft-office365.cloud · in the feed since 2026-10-25 23:31 UTC
    Address on DomainSpoof’s phishing-host list
    217.160.0.235 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · microsoft-office365.cloud resolved to it 2026-11-05 00:46 UTC
    Addresses
    217.160.0.235 · Germany · AS8560 IONOS-AS IONOS SE · IONOS (shared hosting)
    2001:8d8:100f:f000::200
    IONOS
    IONOS (217.160.0.235): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx00.ionos.de
    mx01.ionos.de
    Daily check
    Ended 2026-11-04 22:41 UTC
  67. office365online.live CY · AS47583 · AS-HOSTINGER Hostinger Inte…Contains “office365”
    Address on DomainSpoof’s phishing-host listHostingerMX present
    DetailsHide
    Domain
    office365online.live
    Match
    A domain containing “office365”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .live zone file, already registered
    Registered
    2026-03-15 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · office365online.live resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx1.hostinger.com
    mx2.hostinger.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  68. hotmails.sbs CY · AS47583 · AS-HOSTINGER Hostinger Inte…Contains “hotmail”
    Address on DomainSpoof’s phishing-host listHostingerMX present
    DetailsHide
    Domain
    hotmails.sbs
    Match
    A registered domain containing “hotmail”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .sbs zone file copy it was found in
    Registered
    2026-01-05 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmails.sbs resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    MX
    mx1.hostinger.com
    mx2.hostinger.com
    Daily check
    Ended 2026-11-04 22:41 UTC
  69. secret-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    secret-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · secret-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  70. session-microsoft-trello.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    session-microsoft-trello.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · session-microsoft-trello.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  71. short-authority-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    short-authority-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · short-authority-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  72. shortcut-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    shortcut-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · shortcut-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  73. simulink-microsoft-class.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    simulink-microsoft-class.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · simulink-microsoft-class.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  74. simulink-priority-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    simulink-priority-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · simulink-priority-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  75. smartsheet-microsoft-rest.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    smartsheet-microsoft-rest.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · smartsheet-microsoft-rest.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  76. smartsheet-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    smartsheet-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · smartsheet-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  77. smartsheet-seaborn-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    smartsheet-seaborn-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · smartsheet-seaborn-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  78. snapshot-microsoft-circleci.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    snapshot-microsoft-circleci.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · snapshot-microsoft-circleci.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  79. soap-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    soap-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · soap-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  80. solidworks-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    solidworks-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-25 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · solidworks-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  81. utilization-follower-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    utilization-follower-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · utilization-follower-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  82. variable-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    variable-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · variable-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  83. verilog-microsoft-tablet.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    verilog-microsoft-tablet.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · verilog-microsoft-tablet.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  84. vhdl-microsoft-partition.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    vhdl-microsoft-partition.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · vhdl-microsoft-partition.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  85. wasm-microsoft-bootstrap.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    wasm-microsoft-bootstrap.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · wasm-microsoft-bootstrap.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  86. wasm-wrike-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    wasm-wrike-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · wasm-wrike-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  87. wave-confluence-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    wave-confluence-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · wave-confluence-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  88. waypoint-microsoft-store.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    waypoint-microsoft-store.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · waypoint-microsoft-store.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  89. while-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    while-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · while-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  90. whom-microsoft-connect.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    whom-microsoft-connect.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · whom-microsoft-connect.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  91. yaml-microsoft-vector.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    yaml-microsoft-vector.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-24 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · yaml-microsoft-vector.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  92. office365-sec.xyz TR · AS51557 · TR-ISIMTESCIL-20201202 Isim…Contains “office365”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    office365-sec.xyz
    Match
    A registered domain containing “office365”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .xyz zone file copy it was found in
    Registered
    2025-12-24 · İsimtescil Bilişim A.Ş.
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    93.89.226.17 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · office365-sec.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    93.89.226.17 · Türkiye · AS51557 TR-ISIMTESCIL-20201202 Isimtescil Bilisim A.S.
    Daily check
    Ended 2026-11-04 22:41 UTC
  93. onedrive365.live US · AS214036 · ULTAHOST-AS Ultahost, Inc.Contains “onedrive”
    Address on DomainSpoof’s phishing-host listMX present
    DetailsHide
    Domain
    onedrive365.live
    Match
    A registered domain containing “onedrive”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .live zone file copy it was found in
    Registered
    2025-12-18 · Ultahost, Inc
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    79.133.41.61 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · onedrive365.live resolved to it 2026-11-05 00:46 UTC
    Addresses
    79.133.41.61 · United States · AS214036 ULTAHOST-AS Ultahost, Inc.
    MX
    onedrive365.live
    Daily check
    Ended 2026-11-04 22:41 UTC
  94. hotmailbr.store CY · AS47583 · AS-HOSTINGER Hostinger Inte…Contains “hotmail”
    Address on DomainSpoof’s phishing-host listHostinger
    DetailsHide
    Domain
    hotmailbr.store
    Match
    A registered domain containing “hotmail”, one of the names we match for Microsoft
    Zone file copy
    2026-10-31 · the day of the .store zone file copy it was found in
    Registered
    2025-12-15 · HOSTINGER operations, UAB
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    2.57.91.91 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · hotmailbr.store resolved to it 2026-11-05 00:46 UTC
    Addresses
    2.57.91.91 · Cyprus · AS47583 AS-HOSTINGER Hostinger International Limited · Hostinger (shared hosting)
    Hostinger
    Hostinger (2.57.91.91): shared web hosting and domain registration. One address typically serves many customer sites.
    Daily check
    Ended 2026-11-04 22:41 UTC
  95. instagram-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    instagram-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · instagram-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  96. instagram-when-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    instagram-when-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · instagram-when-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  97. instance-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    instance-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · instance-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  98. jetty-microsoft-drone.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    jetty-microsoft-drone.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · jetty-microsoft-drone.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  99. jetty-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    jetty-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · jetty-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC
  100. jetty-opengl-microsoft.xyz JP · AS7506 · GMO Internet, Inc.Contains “microsoft”
    Address on DomainSpoof’s phishing-host list
    DetailsHide
    Domain
    jetty-opengl-microsoft.xyz
    Match
    A domain containing “microsoft”, one of the names we match for Microsoft
    First found
    2026-11-01 · the day we first found it in the .xyz zone file, already registered
    Registered
    2025-12-10 · GMO Internet Group, Inc. d/b/a Onamae.com
    Listings
    DomainSpoof matches it against the phishing feeds and address lists every hour · snapshot 2026-11-05 10:59 UTC
    Address on DomainSpoof’s phishing-host list
    150.95.255.38 is on DomainSpoof’s list of addresses that hosted confirmed phishing in the last 48 hours · jetty-opengl-microsoft.xyz resolved to it 2026-11-05 00:46 UTC
    Addresses
    150.95.255.38 · Japan · AS7506 GMO-I-R1 - GMO Internet, Inc.
    Daily check
    Ended 2026-11-04 22:41 UTC

More brands in Software & cloud

All brands →