# Official login addresses

> The real sign-in addresses of 15 brands phishers copy most, how to read a link, and where to report a fake. Checked 9 November 2026.

Canonical: https://www.phishclean.com/official-domains
Last updated: 2026-11-09

The real sign-in address of 15 brands that phishing pages copy most, checked by opening each one on 9 November 2026. If a link asks for one of these passwords anywhere else, it isn't the brand.

| Brand | Real sign-in address | Report phishing to |
| --- | --- | --- |
| [Microsoft](https://www.phishclean.com/official-domains/microsoft) | `login.microsoftonline.com` `login.live.com` | [See page](https://www.phishclean.com/official-domains/microsoft#report) |
| [Google](https://www.phishclean.com/official-domains/google) | `accounts.google.com` | [See page](https://www.phishclean.com/official-domains/google#report) |
| [Apple](https://www.phishclean.com/official-domains/apple) | `account.apple.com` `www.icloud.com` | `reportphishing@apple.com` |
| [Amazon](https://www.phishclean.com/official-domains/amazon) | `www.amazon.com` | [See page](https://www.phishclean.com/official-domains/amazon#report) |
| [PayPal](https://www.phishclean.com/official-domains/paypal) | `www.paypal.com` | `phishing@paypal.com` |
| [Facebook](https://www.phishclean.com/official-domains/facebook) | `www.facebook.com` | [See page](https://www.phishclean.com/official-domains/facebook#report) |
| [Netflix](https://www.phishclean.com/official-domains/netflix) | `www.netflix.com` | `phishing@netflix.com` |
| [Adobe](https://www.phishclean.com/official-domains/adobe) | `account.adobe.com` | `phishing@adobe.com` |
| [Docusign](https://www.phishclean.com/official-domains/docusign) | `account.docusign.com` | `verify@docusign.com` |
| [eBay](https://www.phishclean.com/official-domains/ebay) | `signin.ebay.com` | `spoof@ebay.com` |
| [Coinbase](https://www.phishclean.com/official-domains/coinbase) | `login.coinbase.com` | [See page](https://www.phishclean.com/official-domains/coinbase#report) |
| [DHL](https://www.phishclean.com/official-domains/dhl) | `www.dhl.com` | `phishing-dpdhl@dhl.com` |
| [Chase](https://www.phishclean.com/official-domains/chase) | `secure.chase.com` | `phishing@chase.com` |
| [Bank of America](https://www.phishclean.com/official-domains/bank-of-america) | `secure.bankofamerica.com` | `abuse@bofa.com` |
| [IRS](https://www.phishclean.com/official-domains/irs) | `www.irs.gov` | `phishing@irs.gov` |

## How to read any link

Look at the part between `https://` and the first single `/`, and read it from the right. It has to end in the brand's own domain, with only a dot in front of it.

- `https://login.microsoftonline.com/…` is Microsoft.
- `https://microsoftonline.com.account-check.example/…` is not. It belongs to whoever owns `account-check.example`.
- `https://paypal-secure-login.example/…` is not. A hyphen makes a new domain anyone can register.

## What the fakes looked like

In PhishTank's list of live, verified phishing URLs on 5 November 2026, 2,283 were labelled with one of these 15 brands. Only 3.8% had the brand's name anywhere in the hostname, so most fakes give no clue in the address at all. The full picture is in our [phishing URL statistics](https://www.phishclean.com/research/phishing-urls); each brand page has its own numbers and example hostnames.

The same data is available as [JSON](https://www.phishclean.com/official-domains.json), under [CC BY-SA 2.5](https://creativecommons.org/licenses/by-sa/2.5/) as PhishTank's licence requires.

Not sure about a link? Paste it into the [free link checker](https://www.phishclean.com/check-link). It reads the address only and doesn't open the page.

## Questions

### How do I know if a login page is real?

Read the hostname from the right: the part just before the first single slash must end in the brand's own domain, with only a dot in front of it. microsoft.com.account-check.example is not Microsoft; login.microsoftonline.com is. A padlock and a logo prove nothing.

### Do phishing links contain the brand's name?

Usually not. Across the 15 most-copied brands here, 87 of 2,283 live phishing URLs labelled with one of them (3.8%) had the brand's name in the hostname, in PhishTank's list on 5 November 2026.

### Can a phishing page be on a real company domain?

Yes. Google Sites, Google Docs, SharePoint, Adobe Express and Docusign envelopes are real company domains where any customer can publish. The brand pages here list them.

## Add your company

If your customers sign in to your service, you can [verify your login domains](https://www.phishclean.com/official-domains/add) and get a page here they can check before typing a password. You prove the domains are yours with one DNS record. It's free, and we never ask for a link back.

Run security for one of the brands above and something is out of date? Use the same form, or [tell us](https://www.phishclean.com/contact).

Last updated: 9 November 2026, when the sign-in addresses were checked.