# Google login URL: the real address > Google's real sign-in page is on accounts.google.com. How to tell a fake Google link from the real one, with examples from 51 live phishing URLs. Canonical: https://www.phishclean.com/official-domains/google Last updated: 2026-11-09 Google's real sign-in page is on accounts.google.com. If a link takes you anywhere else and asks for your Google password, close it. We opened each address below on 9 November 2026. accounts.google.com Every Google account: Gmail, YouTube, Drive and the rest ## Domains Google uses Not a complete list. Each address below can have subdomains in front of it (`www.`, `login.`), and they are still Google's. - `google.com` - `gmail.com` - `youtube.com` - `googleusercontent.com` - `gstatic.com` ## Real Google domains where anyone can publish These belong to Google, but the pages on them are made by its customers. A sign-in form here is not Google's sign-in page. | Address | Why | Live phishing URLs | | --- | --- | --- | | `sites.google.com` | Anyone can build a free website on Google Sites. | 1,173 | | `docs.google.com` | Anyone can share a Google Doc, Sheet, Slide or Form. | 4,094 | | `forms.gle` | Short links to Google Forms, made by anyone. | 54 | | `script.google.com` | Apps Script web apps, published by anyone. | 49 | | `googleapis.com` | Google Cloud addresses, including Cloud Storage files that any customer can upload. | 46 | | `googleadservices.com` | Ad click links. Anyone who buys a Google ad gets one, and it forwards to their own site. | 3 | | `share.google` | Google's share links, which anyone can create. | 17 | | `firebaseapp.com` | Firebase Hosting sites, made by any developer. | 1,896 | | `web.app` | Firebase Hosting sites, made by any developer. | 1,945 | Live phishing URLs: any brand, counted in PhishTank's list on 5 November 2026. ## How to read the address Look at the part between `https://` and the first single `/`. Read it from the right. The real thing ends in `google.com` or another domain listed below, with nothing but a dot before it. - `https://login.google.com/…` is Google: it ends in `.google.com`. - `https://google.com.account-check.example/…` is not: it ends in `account-check.example`, and Google's name at the front is decoration. - `https://google-secure-login.example/…` is not: a hyphen makes a different domain, and anyone can register one. Everything after the first `/` is chosen by whoever made the page, so `…/google.com/signin` in the path proves nothing. ## What fake Google pages looked like On 5 November 2026, PhishTank listed 51 live, verified phishing URLs that its volunteers labelled Google. - **96.1%** used HTTPS. The padlock means the connection is encrypted, not that the site is Google. - **45.1%** had "google" in the hostname. Most fakes give no such clue, so the absence of Google's name doesn't make a link safe either. - **52.9%** sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered. Hostnames from the same list that use Google's name without being Google's, newest first. Dots are written as `[.]` so none of them is a working link. - google-verify-portal[.]com - verify-google-app[.]netlify[.]app - google[.]workspacedoc[.]com - google[.]documentsharing[.]fr - googleworkspace[.]gestioncompte[.]com - google[.]documentpartage[.]com ## Report a fake Google email or page In Gmail, open the message, open the More menu and choose Report phishing. To report a fake page, use Google's Safe Browsing form at google.com/safebrowsing/report_phish/. Source: [Google: Avoid and report phishing emails](https://support.google.com/mail/answer/8253), checked 9 November 2026. ## Lures to watch for - A page on docs.google.com or sites.google.com is on Google's real domain but was made by whoever shared it. Google never asks for your password inside a Doc, a Form or a Site. - To check a security alert, Google suggests going to myaccount.google.com/notifications yourself instead of following the email. Not sure about a link? Paste it into the [free link checker](https://www.phishclean.com/check-link). It reads the address only and doesn't open the page. The [PhishClean browser extension](https://www.phishclean.com/) also checks each page you open for signs of a fake sign-in form. ## Questions ### What is Google's official login URL? accounts.google.com (Every Google account: Gmail, YouTube, Drive and the rest). A real Google address ends in google.com, gmail.com, youtube.com or another domain the brand owns, read from the right of the hostname. ### How do I report a fake Google email or website? In Gmail, open the message, open the More menu and choose Report phishing. To report a fake page, use Google's Safe Browsing form at google.com/safebrowsing/report_phish/. ### Do fake Google sites use Google's name in the address? In PhishTank's list of live phishing URLs on 5 November 2026, 23 of the 51 URLs labelled Google (45.1%) had the brand's name in the hostname, so most gave no such clue. 96.1% used HTTPS, so a padlock proves nothing. ### Can a phishing page be on a real Google domain? Yes. sites.google.com, docs.google.com, forms.gle, script.google.com, googleapis.com, googleadservices.com, share.google, firebaseapp.com, web.app belong to Google, but the pages there are made by its customers, so a sign-in form there is not Google's sign-in page. PhishTank's list on 5 November 2026 held 9,277 live phishing URLs on these addresses. ## How we checked - **Sign-in addresses:** opened on 9 November 2026 and followed through every redirect to where the sign-in page loads. - **Phishing numbers:** [PhishTank](https://phishtank.org/)'s online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Google count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under [CC BY-SA 2.5](https://creativecommons.org/licenses/by-sa/2.5/); method as in our [phishing URL statistics](https://www.phishclean.com/research/phishing-urls). - **Example hostnames:** hostnames in the whole list that contain "google" but aren't on Google's domains, one per domain. See also: [official sign-in addresses of 15 brands](https://www.phishclean.com/official-domains). Last updated: 9 November 2026, when the sign-in addresses were checked.