{
  "title": "Official login addresses",
  "url": "https://www.phishclean.com/official-domains",
  "checked": "2026-11-09",
  "phishtankSnapshot": "2026-11-05",
  "source": "Sign-in addresses opened by PhishClean; phishing data from PhishTank's online-valid list, https://phishtank.org/",
  "license": "https://creativecommons.org/licenses/by-sa/2.5/",
  "brands": [
    {
      "brand": "Microsoft",
      "url": "https://www.phishclean.com/official-domains/microsoft",
      "verified": null,
      "signIn": [
        {
          "host": "login.microsoftonline.com",
          "url": "https://login.microsoftonline.com/",
          "label": "Work or school accounts, including Microsoft 365 and Outlook at work"
        },
        {
          "host": "login.live.com",
          "url": "https://login.live.com/",
          "label": "Personal Microsoft accounts, including Outlook.com, Xbox and OneDrive"
        }
      ],
      "domains": [
        "microsoft.com",
        "microsoftonline.com",
        "live.com",
        "outlook.com",
        "office.com",
        "microsoft365.com"
      ],
      "openToAnyone": [
        {
          "domain": "sharepoint.com",
          "why": "Anyone with a Microsoft 365 account can share files and pages on sharepoint.com.",
          "livePhishingUrls": 23
        },
        {
          "domain": "onmicrosoft.com",
          "why": "Every Microsoft 365 customer gets a name.onmicrosoft.com address, and scammers sign up too.",
          "livePhishingUrls": 0
        },
        {
          "domain": "office.com",
          "why": "Microsoft Forms links (forms.office.com) can be made by any account holder.",
          "livePhishingUrls": 117
        }
      ],
      "report": {
        "text": "In Outlook, select the message and choose Report, then Report phishing. Microsoft's help page gives no email address for this.",
        "email": null,
        "source": "https://support.microsoft.com/en-us/office/phishing-and-suspicious-behavior-in-outlook-0d882ea5-eedc-4bed-aebc-079ffa1105a3"
      },
      "phishtank": {
        "labelledUrls": 254,
        "httpsShare": 96.9,
        "nameInHostnameShare": 2,
        "onSignUpServicesShare": 28.7,
        "exampleHostnamesDefanged": [
          "microsoftt7[.]vercel[.]app",
          "microsoft09-one[.]vercel[.]app",
          "microsoftoutlook[.]flazio[.]online",
          "microsoftconfig-3[.]vercel[.]app",
          "connectezvousamicrosoftoutlook[.]weebly[.]com",
          "microsoft[.]team365[.]realtrade4[.]com"
        ]
      }
    },
    {
      "brand": "Google",
      "url": "https://www.phishclean.com/official-domains/google",
      "verified": null,
      "signIn": [
        {
          "host": "accounts.google.com",
          "url": "https://accounts.google.com/",
          "label": "Every Google account: Gmail, YouTube, Drive and the rest"
        }
      ],
      "domains": [
        "google.com",
        "gmail.com",
        "youtube.com",
        "googleusercontent.com",
        "gstatic.com"
      ],
      "openToAnyone": [
        {
          "domain": "sites.google.com",
          "why": "Anyone can build a free website on Google Sites.",
          "livePhishingUrls": 1173
        },
        {
          "domain": "docs.google.com",
          "why": "Anyone can share a Google Doc, Sheet, Slide or Form.",
          "livePhishingUrls": 4094
        },
        {
          "domain": "forms.gle",
          "why": "Short links to Google Forms, made by anyone.",
          "livePhishingUrls": 54
        },
        {
          "domain": "script.google.com",
          "why": "Apps Script web apps, published by anyone.",
          "livePhishingUrls": 49
        },
        {
          "domain": "googleapis.com",
          "why": "Google Cloud addresses, including Cloud Storage files that any customer can upload.",
          "livePhishingUrls": 46
        },
        {
          "domain": "googleadservices.com",
          "why": "Ad click links. Anyone who buys a Google ad gets one, and it forwards to their own site.",
          "livePhishingUrls": 3
        },
        {
          "domain": "share.google",
          "why": "Google's share links, which anyone can create.",
          "livePhishingUrls": 17
        },
        {
          "domain": "firebaseapp.com",
          "why": "Firebase Hosting sites, made by any developer.",
          "livePhishingUrls": 1896
        },
        {
          "domain": "web.app",
          "why": "Firebase Hosting sites, made by any developer.",
          "livePhishingUrls": 1945
        }
      ],
      "report": {
        "text": "In Gmail, open the message, open the More menu and choose Report phishing. To report a fake page, use Google's Safe Browsing form at google.com/safebrowsing/report_phish/.",
        "email": null,
        "source": "https://support.google.com/mail/answer/8253"
      },
      "phishtank": {
        "labelledUrls": 51,
        "httpsShare": 96.1,
        "nameInHostnameShare": 45.1,
        "onSignUpServicesShare": 52.9,
        "exampleHostnamesDefanged": [
          "google-verify-portal[.]com",
          "verify-google-app[.]netlify[.]app",
          "google[.]workspacedoc[.]com",
          "google[.]documentsharing[.]fr",
          "googleworkspace[.]gestioncompte[.]com",
          "google[.]documentpartage[.]com"
        ]
      }
    },
    {
      "brand": "Apple",
      "url": "https://www.phishclean.com/official-domains/apple",
      "verified": null,
      "signIn": [
        {
          "host": "account.apple.com",
          "url": "https://account.apple.com/sign-in",
          "label": "Your Apple Account (formerly Apple ID). appleid.apple.com still works too."
        },
        {
          "host": "www.icloud.com",
          "url": "https://www.icloud.com/",
          "label": "iCloud on the web: Mail, Photos, Find My"
        }
      ],
      "domains": [
        "apple.com",
        "icloud.com"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Forward suspicious emails that look like they come from Apple to reportphishing@apple.com.",
        "email": "reportphishing@apple.com",
        "source": "https://support.apple.com/102568"
      },
      "phishtank": {
        "labelledUrls": 37,
        "httpsShare": 94.6,
        "nameInHostnameShare": 8.1,
        "onSignUpServicesShare": 18.9,
        "exampleHostnamesDefanged": [
          "mail[.]cases-apple-id[.]com",
          "www[.]applecreditlimit[.]com",
          "appleid[.]scure[.]icu",
          "apple-icloud[.]azurewebsites[.]net",
          "applemymusic[.]com",
          "pkobp[.]appleenespanol[.]com"
        ]
      }
    },
    {
      "brand": "Amazon",
      "url": "https://www.phishclean.com/official-domains/amazon",
      "verified": null,
      "signIn": [
        {
          "host": "www.amazon.com",
          "url": "https://www.amazon.com/",
          "label": "Sign-in is at www.amazon.com/ap/signin, or the same path on your country's store (amazon.co.uk, amazon.de, amazon.in and so on)"
        }
      ],
      "domains": [
        "amazon.com",
        "amazon.co.uk",
        "amazon.de",
        "amazon.in",
        "amazon.ca",
        "amazon.com.au"
      ],
      "openToAnyone": [
        {
          "domain": "amazonaws.com",
          "why": "Amazon Web Services is a cloud anyone can rent. A page on amazonaws.com is a customer's page, not Amazon's store.",
          "livePhishingUrls": 73
        },
        {
          "domain": "awstrack.me",
          "why": "Click-tracking links from Amazon's email service, which any AWS customer can send.",
          "livePhishingUrls": 22
        }
      ],
      "report": {
        "text": "Follow the steps on Amazon's own Report a scam help page. We could not open that page to confirm its current email address, so we don't print one here.",
        "email": null,
        "source": "https://www.amazon.com/gp/help/customer/display.html?nodeId=GRGRY7AQ3LMPXVCV"
      },
      "phishtank": {
        "labelledUrls": 356,
        "httpsShare": 94.1,
        "nameInHostnameShare": 2.2,
        "onSignUpServicesShare": 10.7,
        "exampleHostnamesDefanged": [
          "amazoncheckout[.]netlify[.]app",
          "amazon-video-musique[.]com",
          "primevideoamazon[.]myminfin-idaccount[.]org",
          "amazon-paiement[.]com",
          "amazon-refund[.]cc",
          "amazonwebservices[.]security-unauthorised-request[.]com"
        ]
      }
    },
    {
      "brand": "PayPal",
      "url": "https://www.phishclean.com/official-domains/paypal",
      "verified": null,
      "signIn": [
        {
          "host": "www.paypal.com",
          "url": "https://www.paypal.com/signin",
          "label": "Every PayPal account signs in at www.paypal.com/signin"
        }
      ],
      "domains": [
        "paypal.com",
        "paypalobjects.com"
      ],
      "openToAnyone": [
        {
          "domain": "paypal.me",
          "why": "PayPal.Me links belong to individual PayPal users, so the name after the slash is whoever created it.",
          "livePhishingUrls": 0
        }
      ],
      "report": {
        "text": "Forward the whole email to phishing@paypal.com, then delete it. PayPal asks you not to change the subject line or send it as an attachment.",
        "email": "phishing@paypal.com",
        "source": "https://www.paypal.com/us/smarthelp/article/How-do-I-report-a-fake-PayPal-email-or-website-FAQ438"
      },
      "phishtank": {
        "labelledUrls": 57,
        "httpsShare": 93,
        "nameInHostnameShare": 10.5,
        "onSignUpServicesShare": 33.3,
        "exampleHostnamesDefanged": [
          "paypal-transactions[.]sbs",
          "paypal3[.]vercel[.]app",
          "more-paypal[.]wixstudio[.]com",
          "payme-paypal[.]com",
          "www[.]paypal-banking[.]pro",
          "meinpaypal[.]lnc[.]gmbh"
        ]
      }
    },
    {
      "brand": "Facebook",
      "url": "https://www.phishclean.com/official-domains/facebook",
      "verified": null,
      "signIn": [
        {
          "host": "www.facebook.com",
          "url": "https://www.facebook.com/",
          "label": "Facebook signs in at www.facebook.com (m.facebook.com on phones)"
        }
      ],
      "domains": [
        "facebook.com",
        "fb.com",
        "facebookmail.com",
        "meta.com"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Use the Report option on the post, message or Page inside Facebook. We could not open Meta's help page to confirm an email address, and the one most sites repeat dates from 2012, so we don't print it here.",
        "email": null,
        "source": "https://www.facebook.com/help/"
      },
      "phishtank": {
        "labelledUrls": 373,
        "httpsShare": 98.7,
        "nameInHostnameShare": 1.6,
        "onSignUpServicesShare": 81.5,
        "exampleHostnamesDefanged": [
          "autho-facebook-appp[.]weebly[.]com",
          "facebookctf[.]vercel[.]app",
          "facebook[.]market-34545647656[.]club",
          "video-share-facebook[.]weebly[.]com",
          "noreplybusinessfacebook[.]com",
          "facebook-downloader[.]czhyk[.]biz[.]id"
        ]
      }
    },
    {
      "brand": "Netflix",
      "url": "https://www.phishclean.com/official-domains/netflix",
      "verified": null,
      "signIn": [
        {
          "host": "www.netflix.com",
          "url": "https://www.netflix.com/login",
          "label": "www.netflix.com/login (it adds your country to the path)"
        }
      ],
      "domains": [
        "netflix.com"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Forward the email to phishing@netflix.com. If the forward bounces, Netflix already has a copy and you can delete it.",
        "email": "phishing@netflix.com",
        "source": "https://help.netflix.com/en/node/65674"
      },
      "phishtank": {
        "labelledUrls": 123,
        "httpsShare": 98.4,
        "nameInHostnameShare": 4.1,
        "onSignUpServicesShare": 16.3,
        "exampleHostnamesDefanged": [
          "netflix-za[.]com",
          "netflix-formulaire[.]info",
          "netflixloinh[.]godaddysites[.]com",
          "netflix-updatepayment[.]com",
          "netflixbymanoj[.]vercel[.]app",
          "netflixinyourneighborhoodnm[.]com"
        ]
      }
    },
    {
      "brand": "Adobe",
      "url": "https://www.phishclean.com/official-domains/adobe",
      "verified": null,
      "signIn": [
        {
          "host": "account.adobe.com",
          "url": "https://account.adobe.com/",
          "label": "Adobe accounts: Creative Cloud, Acrobat, Express"
        }
      ],
      "domains": [
        "adobe.com"
      ],
      "openToAnyone": [
        {
          "domain": "adobe.com",
          "why": "Adobe Express pages and shared Acrobat files live on adobe.com addresses but are made by any Adobe user.",
          "livePhishingUrls": 1113
        },
        {
          "domain": "adobesign.com",
          "why": "Acrobat Sign agreements can be sent by any Acrobat Sign customer.",
          "livePhishingUrls": 1
        },
        {
          "domain": "adobecqms.net",
          "why": "Adobe Managed Services hosts its customers' own websites here.",
          "livePhishingUrls": 1
        }
      ],
      "report": {
        "text": "Forward suspected phishing to phishing@adobe.com.",
        "email": "phishing@adobe.com",
        "source": "https://blog.adobe.com/security/building-resilience-against-ever-evolving-phishing-attacks"
      },
      "phishtank": {
        "labelledUrls": 73,
        "httpsShare": 89,
        "nameInHostnameShare": 13.7,
        "onSignUpServicesShare": 30.1,
        "exampleHostnamesDefanged": [
          "adobe[.]professional-interviews[.]com",
          "adobe-knwrgjnwghnwhrkfnejwnfkje[.]pages[.]dev"
        ]
      }
    },
    {
      "brand": "Docusign",
      "url": "https://www.phishclean.com/official-domains/docusign",
      "verified": null,
      "signIn": [
        {
          "host": "account.docusign.com",
          "url": "https://account.docusign.com/",
          "label": "Docusign accounts"
        }
      ],
      "domains": [
        "docusign.com",
        "docusign.net"
      ],
      "openToAnyone": [
        {
          "domain": "docusign.net",
          "why": "Docusign envelopes come from Docusign's real servers, but the sender can be anyone with a Docusign account.",
          "livePhishingUrls": 0
        }
      ],
      "report": {
        "text": "Forward the message as an attachment to verify@docusign.com, or use Docusign's Report Abuse option. (Older Docusign alerts named spam@docusign.com.)",
        "email": "verify@docusign.com",
        "source": "https://www.docusign.com/trust/alerts/fraud-alert-phishing-scams-using-fake-blurred-documents-to-gain-device-access"
      },
      "phishtank": {
        "labelledUrls": 33,
        "httpsShare": 93.9,
        "nameInHostnameShare": 3,
        "onSignUpServicesShare": 33.3,
        "exampleHostnamesDefanged": [
          "docusignredtail[.]web[.]app"
        ]
      }
    },
    {
      "brand": "eBay",
      "url": "https://www.phishclean.com/official-domains/ebay",
      "verified": null,
      "signIn": [
        {
          "host": "signin.ebay.com",
          "url": "https://signin.ebay.com/",
          "label": "eBay accounts (country sites such as ebay.co.uk use their own signin. address)"
        }
      ],
      "domains": [
        "ebay.com",
        "ebay.co.uk",
        "ebay.de",
        "ebay.com.au",
        "ebay.ca"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Forward the email as an attachment to spoof@ebay.com.",
        "email": "spoof@ebay.com",
        "source": "https://www.ebay.com/help/account/messages/messages?id=4195"
      },
      "phishtank": {
        "labelledUrls": 34,
        "httpsShare": 94.1,
        "nameInHostnameShare": 0,
        "onSignUpServicesShare": 67.6,
        "exampleHostnamesDefanged": []
      }
    },
    {
      "brand": "Coinbase",
      "url": "https://www.phishclean.com/official-domains/coinbase",
      "verified": null,
      "signIn": [
        {
          "host": "login.coinbase.com",
          "url": "https://login.coinbase.com/",
          "label": "www.coinbase.com/signin sends you here"
        }
      ],
      "domains": [
        "coinbase.com"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Contact Coinbase through its help center at help.coinbase.com. We could not open Coinbase's phishing page to confirm a reporting address.",
        "email": null,
        "source": "https://help.coinbase.com/"
      },
      "phishtank": {
        "labelledUrls": 23,
        "httpsShare": 100,
        "nameInHostnameShare": 30.4,
        "onSignUpServicesShare": 47.8,
        "exampleHostnamesDefanged": [
          "621883coinbase[.]com",
          "coinbase-connetct[.]vercel[.]app",
          "237780coinbase[.]com",
          "266385coinbase[.]com",
          "help-coinbase[.]beer",
          "coinbaseverify[.]vercel[.]app"
        ]
      }
    },
    {
      "brand": "DHL",
      "url": "https://www.phishclean.com/official-domains/dhl",
      "verified": null,
      "signIn": [
        {
          "host": "www.dhl.com",
          "url": "https://www.dhl.com/",
          "label": "Tracking and accounts start at www.dhl.com (dhl.de in Germany)"
        }
      ],
      "domains": [
        "dhl.com",
        "dhl.de",
        "dpdhl.com",
        "dhl-news.com"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Send the suspicious email as an attachment to phishing-dpdhl@dhl.com. Some country pages give phishing@dhl.com instead.",
        "email": "phishing-dpdhl@dhl.com",
        "source": "https://www.dhl.com/fraud"
      },
      "phishtank": {
        "labelledUrls": 22,
        "httpsShare": 86.4,
        "nameInHostnameShare": 9.1,
        "onSignUpServicesShare": 13.6,
        "exampleHostnamesDefanged": [
          "dhl-deliveries-express[.]weebly[.]com",
          "dhl[.]com-paiement[.]fr",
          "dhl-expresss[.]weebly[.]com",
          "sgin12-dhl[.]mdbgo[.]io"
        ]
      }
    },
    {
      "brand": "Chase",
      "url": "https://www.phishclean.com/official-domains/chase",
      "verified": null,
      "signIn": [
        {
          "host": "secure.chase.com",
          "url": "https://www.chase.com/",
          "label": "Signing in on www.chase.com takes you to secure.chase.com"
        }
      ],
      "domains": [
        "chase.com",
        "jpmorgan.com",
        "jpmorganchase.com"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Forward the email to phishing@chase.com. If you shared details or lost money, call the number on the back of your card.",
        "email": "phishing@chase.com",
        "source": "https://www.chase.com/digital/resources/privacy-security/security/report-fraud"
      },
      "phishtank": {
        "labelledUrls": 29,
        "httpsShare": 100,
        "nameInHostnameShare": 6.9,
        "onSignUpServicesShare": 72.4,
        "exampleHostnamesDefanged": [
          "chase-acess[.]vercel[.]app",
          "chase[.]com[.]cobblestonesw[.]com"
        ]
      }
    },
    {
      "brand": "Bank of America",
      "url": "https://www.phishclean.com/official-domains/bank-of-america",
      "verified": null,
      "signIn": [
        {
          "host": "secure.bankofamerica.com",
          "url": "https://www.bankofamerica.com/",
          "label": "Signing in on www.bankofamerica.com takes you to secure.bankofamerica.com"
        }
      ],
      "domains": [
        "bankofamerica.com",
        "bofa.com"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Forward suspicious emails or texts that use Bank of America's name to abuse@bofa.com.",
        "email": "abuse@bofa.com",
        "source": "https://web.bankofamerica.com/en/security/report-suspicious-activity"
      },
      "phishtank": {
        "labelledUrls": 31,
        "httpsShare": 100,
        "nameInHostnameShare": 0,
        "onSignUpServicesShare": 71,
        "exampleHostnamesDefanged": [
          "sbofaeddprepaid[.]w3spaces[.]com"
        ]
      }
    },
    {
      "brand": "IRS",
      "url": "https://www.phishclean.com/official-domains/irs",
      "verified": null,
      "signIn": [
        {
          "host": "www.irs.gov",
          "url": "https://www.irs.gov/your-account",
          "label": "Your IRS online account starts at irs.gov/your-account"
        }
      ],
      "domains": [
        "irs.gov"
      ],
      "openToAnyone": [],
      "report": {
        "text": "Send the email to phishing@irs.gov with \"IRS\" in the subject line, without replying or clicking anything first.",
        "email": "phishing@irs.gov",
        "source": "https://www.irs.gov/privacy-disclosure/report-phishing"
      },
      "phishtank": {
        "labelledUrls": 787,
        "httpsShare": 93.8,
        "nameInHostnameShare": 1.1,
        "onSignUpServicesShare": 48.8,
        "exampleHostnamesDefanged": [
          "irs[.]getdigitalassetcompliance[.]com",
          "irs[.]denhamworks[.]click",
          "irs[.]mydigitalassetcompliance[.]com",
          "irs[.]digitalasset-platform[.]com",
          "irs[.]digitalcomplianceportal[.]com",
          "irs-internal-prototypes[.]com"
        ]
      }
    }
  ]
}