# Phishing sites impersonating Office 365

PhishDestroy has recorded 12 phishing domains impersonating Office 365 since 2025-08-25, 1 of them in the last 30 days. The most used registrars are Amazon Registrar and Register SPA; the most common TLDs are .com and .br. Open Office 365 only from its official app or a saved bookmark.

12Domains, all time

1Last 30 days

8Online at last check

3Confirmed takedowns

## New domains in the last 90 days

Office 365 phishing domains detected per day: 5 from 2026-07-25 to 2026-10-22; peak 2.

## How to tell a fake Office 365 site

Words most often added to the brand in reported domains: zoecondominios, hotmail, session, cronosmsp, avbzbxn, haulonlineshopgroup, hollywooddiqitalblueprint, financialalertsystem, emailnotificationz, agrrements.
- Type the address yourself or use a bookmark; phishing links for Office 365 arrive through ads, search results, direct messages and fake support accounts.
- Check the full domain before you sign in: look for extra words, hyphens, a different TLD or look-alike letters.
- Office 365 does not ask you to confirm your password or card details through a link in an email or SMS.

Paste a suspicious address into the [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker) or check it against the [DestroyList](https://phishdestroy.io/developer-tools/destroylist-check).

## Latest Office 365 phishing domains

The 12 most recently detected domains impersonating Office 365
Domain | First detected | Status at last check | Registrar | 
[welsun.pl](https://phishdestroy.io/domain/welsun.pl/) | 2026-09-22 | Online | home.pl sp. z o.o | 
[hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br](https://phishdestroy.io/domain/hotmail-session-nmjk0bri-ww5ct9w0m-----yo26j491vd.zoecondominios.com.br/) | 2026-09-11 | Online | — | 
[hotmail-session-ckgu2ysl-8ueczirgl-----arstocjwsn.zoecondominios.com.br](https://phishdestroy.io/domain/hotmail-session-ckgu2ysl-8ueczirgl-----arstocjwsn.zoecondominios.com.br/) | 2026-09-11 | Online | — | 
[marketplace.zoecondominios.com.br](https://phishdestroy.io/domain/marketplace.zoecondominios.com.br/) | 2026-08-23 | Online | — | 
[marketplaces.zoecondominios.com.br](https://phishdestroy.io/domain/marketplaces.zoecondominios.com.br/) | 2026-08-23 | Online | — | 
[agrrements-contract.onrender.com](https://phishdestroy.io/domain/agrrements-contract.onrender.com/) | 2026-04-27 | Taken down | Render Services | 
[emailnotificationz.com](https://phishdestroy.io/domain/emailnotificationz.com/) | 2026-03-26 | Offline | Amazon Registrar | 
[financialalertsystem.com](https://phishdestroy.io/domain/financialalertsystem.com/) | 2026-03-24 | Offline | Amazon Registrar | 
[hollywooddiqitalblueprint.com](https://phishdestroy.io/domain/hollywooddiqitalblueprint.com/) | 2026-02-26 | Offline | NameCheap | 
[haulonlineshopgroup.vip](https://phishdestroy.io/domain/haulonlineshopgroup.vip/) | 2026-01-07 | Offline | Gname.com | 
[avbzbxn.godaddysites.com](https://phishdestroy.io/domain/avbzbxn.godaddysites.com/) | 2025-11-13 | Taken down | GoDaddy.com | 
[cronosmsp.com](https://phishdestroy.io/domain/cronosmsp.com/) | 2025-08-25 | Taken down | Register SPA | 

[All 12 Office 365 reports](https://phishdestroy.io/domain/?brand=Office 365)

## Where they are registered and hosted

### Registrars

- [Amazon Registrar](https://phishdestroy.io/registrar/amazon-registrar/)2
- Register SPA1
- [GoDaddy.com](https://phishdestroy.io/registrar/godaddy/)1
- [Gname.com](https://phishdestroy.io/registrar/name-com/)1
- [NameCheap](https://phishdestroy.io/registrar/namecheap/)1
- Render Services1
- home.pl sp. z o.o1

### Top-level domains

- [.com](https://phishdestroy.io/tld/com/)6
- [.br](https://phishdestroy.io/tld/br/)4
- [.vip](https://phishdestroy.io/tld/vip/)1
- [.pl](https://phishdestroy.io/tld/pl/)1

### Hosting networks

- Amazon.com, Inc.2
- RouterHosting LLC2
- GOOGLE-CLOUD-PLATFORM, US1
- AMAZON-02, US1
- CLOUDFLARENET, US1
- NAMECHEAP-NET - Namecheap, Inc., US1
- Render1

## Related

- [Typosquatting](https://phishdestroy.io/glossary/typosquatting/)
- [Homoglyph](https://phishdestroy.io/glossary/homoglyph/)
- [Phishing kit](https://phishdestroy.io/glossary/phishing-kit/)
- [Homoglyph Checker](https://phishdestroy.io/developer-tools/homoglyph-checker)
- [Abuse Report Generator](https://phishdestroy.io/developer-tools/abuse-report-generator)
- [If you already used a fake site: emergency guide](https://phishdestroy.io/critical-action)
- [All impersonated brands](https://phishdestroy.io/brand/)

Data: PhishDestroy domain-report database, built 2026-10-22. Counts cover every reported domain whose stored target brand is Office 365; share of all PhishDestroy reports: 0.01%.

Canonical: https://phishdestroy.io/brand/office-365/