Phishing sites impersonating Office 365

PhishDestroy has recorded 12 phishing domains impersonating Office 365 since 2025-08-25, 1 of them in the last 30 days. The most used registrars are Amazon Registrar and Register SPA; the most common TLDs are .com and .br. Open Office 365 only from its official app or a saved bookmark.

12
Domains, all time
1
Last 30 days
8
Online at last check
3
Confirmed takedowns

New domains in the last 90 days

2026-07-25: 02026-07-26: 02026-07-27: 02026-07-28: 02026-07-29: 02026-07-30: 02026-07-31: 02026-08-01: 02026-08-02: 02026-08-03: 02026-08-04: 02026-08-05: 02026-08-06: 02026-08-07: 02026-08-08: 02026-08-09: 02026-08-10: 02026-08-11: 02026-08-12: 02026-08-13: 02026-08-14: 02026-08-15: 02026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 22026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 02026-08-28: 02026-08-29: 02026-08-30: 02026-08-31: 02026-09-01: 02026-09-02: 02026-09-03: 02026-09-04: 02026-09-05: 02026-09-06: 02026-09-07: 02026-09-08: 02026-09-09: 02026-09-10: 02026-09-11: 22026-09-12: 02026-09-13: 02026-09-14: 02026-09-15: 02026-09-16: 02026-09-17: 02026-09-18: 02026-09-19: 02026-09-20: 02026-09-21: 02026-09-22: 12026-09-23: 02026-09-24: 02026-09-25: 02026-09-26: 02026-09-27: 02026-09-28: 02026-09-29: 02026-09-30: 02026-10-01: 02026-10-02: 02026-10-03: 02026-10-04: 02026-10-05: 02026-10-06: 02026-10-07: 02026-10-08: 02026-10-09: 02026-10-10: 02026-10-11: 02026-10-12: 02026-10-13: 02026-10-14: 02026-10-15: 02026-10-16: 02026-10-17: 02026-10-18: 02026-10-19: 02026-10-20: 02026-10-21: 02026-10-22: 0
Office 365 phishing domains detected per day: 5 from 2026-07-25 to 2026-10-22; peak 2.

How to tell a fake Office 365 site

Words most often added to the brand in reported domains: zoecondominios, hotmail, session, cronosmsp, avbzbxn, haulonlineshopgroup, hollywooddiqitalblueprint, financialalertsystem, emailnotificationz, agrrements.

  • Type the address yourself or use a bookmark; phishing links for Office 365 arrive through ads, search results, direct messages and fake support accounts.
  • Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
  • Office 365 does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the Homoglyph Checker or check it against the DestroyList.

Latest Office 365 phishing domains

The 12 most recently detected domains impersonating Office 365
DomainFirst detectedStatus at last checkRegistrar
welsun.pl2026-09-22Onlinehome.pl sp. z o.o
hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br2026-09-11Online—
hotmail-session-ckgu2ysl-8ueczirgl-----arstocjwsn.zoecondominios.com.br2026-09-11Online—
marketplace.zoecondominios.com.br2026-08-23Online—
marketplaces.zoecondominios.com.br2026-08-23Online—
agrrements-contract.onrender.com2026-04-27Taken downRender Services
emailnotificationz.com2026-03-26OfflineAmazon Registrar
financialalertsystem.com2026-03-24OfflineAmazon Registrar
hollywooddiqitalblueprint.com2026-02-26OfflineNameCheap
haulonlineshopgroup.vip2026-01-07OfflineGname.com
avbzbxn.godaddysites.com2025-11-13Taken downGoDaddy.com
cronosmsp.com2025-08-25Taken downRegister SPA

All 12 Office 365 reports

Where they are registered and hosted

Registrars

  1. Amazon Registrar2
  2. Register SPA1
  3. GoDaddy.com1
  4. Gname.com1
  5. NameCheap1
  6. Render Services1
  7. home.pl sp. z o.o1

Top-level domains

  1. .com6
  2. .br4
  3. .vip1
  4. .pl1

Hosting networks

  1. Amazon.com, Inc.2
  2. RouterHosting LLC2
  3. GOOGLE-CLOUD-PLATFORM, US1
  4. AMAZON-02, US1
  5. CLOUDFLARENET, US1
  6. NAMECHEAP-NET - Namecheap, Inc., US1
  7. Render1

Related

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Office 365; share of all PhishDestroy reports: 0.01%.