Google login URL: the real address
Google's real sign-in page is on accounts.google.com. If a link takes you anywhere else and asks for your Google password, close it. We opened each address below on 9 November 2026.
Every Google account: Gmail, YouTube, Drive and the rest
Domains Google uses
Not a complete list. Each address below can have subdomains in front of it (www., login.), and they are still Google's.
google.comgmail.comyoutube.comgoogleusercontent.comgstatic.com
Real Google domains where anyone can publish
These belong to Google, but the pages on them are made by its customers. A sign-in form here is not Google's sign-in page.
| Address | Why | Live phishing URLs |
|---|---|---|
sites. | Anyone can build a free website on Google Sites. | 1,173 |
docs. | Anyone can share a Google Doc, Sheet, Slide or Form. | 4,094 |
forms. | Short links to Google Forms, made by anyone. | 54 |
script. | Apps Script web apps, published by anyone. | 49 |
googleapis. | Google Cloud addresses, including Cloud Storage files that any customer can upload. | 46 |
googleadservices. | Ad click links. Anyone who buys a Google ad gets one, and it forwards to their own site. | 3 |
share. | Google's share links, which anyone can create. | 17 |
firebaseapp. | Firebase Hosting sites, made by any developer. | 1,896 |
web. | Firebase Hosting sites, made by any developer. | 1,945 |
Live phishing URLs: any brand, counted in PhishTank's list on 5 November 2026.
How to read the address
Look at the part between https:// and the first single /. Read it from the right. The real thing ends in google.com or another domain listed below, with nothing but a dot before it.
https://login.google.com/…is Google: it ends in.google.com.https://google.com.account-check.example/…is not: it ends inaccount-check.example, and Google's name at the front is decoration.https://google-secure-login.example/…is not: a hyphen makes a different domain, and anyone can register one.
Everything after the first / is chosen by whoever made the page, so …/google.com/signin in the path proves nothing.
What fake Google pages looked like
On 5 November 2026, PhishTank listed 51 live, verified phishing URLs that its volunteers labelled Google.
- 96.1% used HTTPS. The padlock means the connection is encrypted, not that the site is Google.
- 45.1% had "google" in the hostname. Most fakes give no such clue, so the absence of Google's name doesn't make a link safe either.
- 52.9% sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered.
Hostnames from the same list that use Google's name without being Google's, newest first. Dots are written as [.] so none of them is a working link.
- google-verify-portal[.]com
- verify-google-app[.]netlify[.]app
- google[.]workspacedoc[.]com
- google[.]documentsharing[.]fr
- googleworkspace[.]gestioncompte[.]com
- google[.]documentpartage[.]com
Report a fake Google email or page
In Gmail, open the message, open the More menu and choose Report phishing. To report a fake page, use Google's Safe Browsing form at google.com/safebrowsing/report_phish/.
Source: Google: Avoid and report phishing emails, checked 9 November 2026.
Lures to watch for
- A page on docs.google.com or sites.google.com is on Google's real domain but was made by whoever shared it. Google never asks for your password inside a Doc, a Form or a Site.
- To check a security alert, Google suggests going to myaccount.google.com/notifications yourself instead of following the email.
Not sure about a link? Paste it into the free link checker. It reads the address only and doesn't open the page. The PhishClean browser extension also checks each page you open for signs of a fake sign-in form.
Questions
What is Google's official login URL?
accounts.google.com (Every Google account: Gmail, YouTube, Drive and the rest). A real Google address ends in google.com, gmail.com, youtube.com or another domain the brand owns, read from the right of the hostname.
How do I report a fake Google email or website?
In Gmail, open the message, open the More menu and choose Report phishing. To report a fake page, use Google's Safe Browsing form at google.com/safebrowsing/report_phish/.
Do fake Google sites use Google's name in the address?
In PhishTank's list of live phishing URLs on 5 November 2026, 23 of the 51 URLs labelled Google (45.1%) had the brand's name in the hostname, so most gave no such clue. 96.1% used HTTPS, so a padlock proves nothing.
Can a phishing page be on a real Google domain?
Yes. sites.google.com, docs.google.com, forms.gle, script.google.com, googleapis.com, googleadservices.com, share.google, firebaseapp.com, web.app belong to Google, but the pages there are made by its customers, so a sign-in form there is not Google's sign-in page. PhishTank's list on 5 November 2026 held 9,277 live phishing URLs on these addresses.
How we checked
- Sign-in addresses: opened on 9 November 2026 and followed through every redirect to where the sign-in page loads.
- Phishing numbers: PhishTank's online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Google count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under CC BY-SA 2.5; method as in our phishing URL statistics.
- Example hostnames: hostnames in the whole list that contain "google" but aren't on Google's domains, one per domain.
See also: official sign-in addresses of 15 brands.
Last updated: , when the sign-in addresses were checked.