Official login addresses
The real sign-in address of 15 brands that phishing pages copy most, checked by opening each one on 9 November 2026. If a link asks for one of these passwords anywhere else, it isn't the brand.
| Brand | Real sign-in address | Report phishing to |
|---|---|---|
| Microsoft | login.login. | See page |
accounts. | See page | |
| Apple | account.www. | reportphishing |
| Amazon | www. | See page |
| PayPal | www. | phishing |
www. | See page | |
| Netflix | www. | phishing |
| Adobe | account. | phishing |
| Docusign | account. | verify |
| eBay | signin. | spoof |
| Coinbase | login. | See page |
| DHL | www. | phishing-dpdhl |
| Chase | secure. | phishing |
| Bank of America | secure. | abuse |
| IRS | www. | phishing |
How to read any link
Look at the part between https:// and the first single /, and read it from the right. It has to end in the brand's own domain, with only a dot in front of it.
https://login.microsoftonline.com/…is Microsoft.https://microsoftonline.com.account-check.example/…is not. It belongs to whoever ownsaccount-check.example.https://paypal-secure-login.example/…is not. A hyphen makes a new domain anyone can register.
What the fakes looked like
In PhishTank's list of live, verified phishing URLs on 5 November 2026, 2,283 were labelled with one of these 15 brands. Only 3.8% had the brand's name anywhere in the hostname, so most fakes give no clue in the address at all. The full picture is in our phishing URL statistics; each brand page has its own numbers and example hostnames.
The same data is available as JSON, under CC BY-SA 2.5 as PhishTank's licence requires.
Not sure about a link? Paste it into the free link checker. It reads the address only and doesn't open the page.
Questions
How do I know if a login page is real?
Read the hostname from the right: the part just before the first single slash must end in the brand's own domain, with only a dot in front of it. microsoft.com.account-check.example is not Microsoft; login.microsoftonline.com is. A padlock and a logo prove nothing.
Do phishing links contain the brand's name?
Usually not. Across the 15 most-copied brands here, 87 of 2,283 live phishing URLs labelled with one of them (3.8%) had the brand's name in the hostname, in PhishTank's list on 5 November 2026.
Can a phishing page be on a real company domain?
Yes. Google Sites, Google Docs, SharePoint, Adobe Express and Docusign envelopes are real company domains where any customer can publish. The brand pages here list them.
Add your company
If your customers sign in to your service, you can verify your login domains and get a page here they can check before typing a password. You prove the domains are yours with one DNS record. It's free, and we never ask for a link back.
Run security for one of the brands above and something is out of date? Use the same form, or tell us.
Last updated: , when the sign-in addresses were checked.