Google phishing & impersonation
Tech & Cloudgoogleusercontent.com
165
Sites impersonating it
87
New in the last 30 days
9
Campaigns
2026-10-24
Last detected
2026-07-272026-10-24
Where these sites are hosted
147 on free hosting platforms, 109 on 92 registered domains
plesk.page · 55netlify.app · 29pages.dev · 19vercel.app · 17workers.dev · 15googleapis.com · 4.com · 69.dev · 13.com.cn · 6.cc · 3.cn · 2.app · 2
Campaigns
Phishing kits we track as hunts, and how many of the sites below each one covers. A site can belong to more than one.
32 of 165 sites · last 2026-10-07
7 of 165 sites · last 2026-10-18
3 of 165 sites · last 2026-10-17
2 of 165 sites · last 2026-09-30
1 of 165 site · last 2026-10-21
1 of 165 site · last 2026-10-21
1 of 165 site · last 2026-10-18
ErrTraffic / Exvicy — check-in servers (178.16.52.101, 158.94.208.87) and their rotating domainscritical
1 of 165 site · last 2026-10-10
Windows ClickFix: 'Human Verification' overlay (Win+X, Terminal) — injected blockchain loadercritical
1 of 165 site · last 2026-10-10
Official domains
googleusercontent.comgoogle.grgoogle.com.sagoogle.isgoogle.co.ilgoogle.co.idgoogle.mdgoogle.com.argoogle.com.augmail.comgoogle.itgoogle.co.ukgoogle.fiwithgoogle.comgoogle.iegoogle.comgoogle.clgoogle.nogoogle.jegoogle.com.phgoogle.begoogle.rugoogle.com.brgoogle.chgoogle.com.mmgoogle.co.kegoogle.ae
A match on a host outside these domains is recorded as impersonation. We look for the brand name in the address, page title and screenshot, its logo on a non-official site, and our AI analysis naming it.
Also known as
gmail
Sites impersonating Google
50 of 256 sites · newest first · repeat scans of a site are grouped
Showing all sites, including 91 lower-risk copies that neither our rule engine nor our AI analysis rates high risk. Hide them
RulesMaliciousAIHigh RiskIdentified as Google by our AI analysisAI analysis
RulesMedium RiskAILow Risklower riskIdentified as Google by our AI analysisAI analysis
metamask-docs-75mpj2s96-consensys-ddffed67.vercel. app Custom authentication | MetaMask developer documentation2026-10-24RulesHigh RiskAIHigh RiskIdentified as Google by our AI analysisAI analysis
RulesHigh RiskAIHigh Risk“Google” in the hostnameAI analysis
RulesHigh RiskAIHigh RiskIdentified as Google by our AI analysisAI analysis
RulesMaliciousAIHigh Risk“Google” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“Google” in the page titleAI analysis
RulesLow RiskAIHigh RiskIdentified as Google by our AI analysisAI analysis
firebasestorage.googleapis. com 2026-10-22 · seen 7×RulesMedium RiskAILegitimatelower risk“Google” in the hostnameScreenshot textPage text
RulesMaliciousAIHigh RiskKnown Kit: Google Drive shared-file lure behind a Turnstile gate, leading to a fake Google sign-in relayed to the operator (gdrive-turnstile-signin-relay-2026-10)“Google” in the page titleAI analysis
RulesMaliciousAIHigh RiskKnown Kit: AgtaBackup operator: fake Google Meet, Zoom and Google Drive update pages that install remote-access agents (agtabackup-meeting-update-rmm-2026-10)“Google” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“Google” in the hostnameAI analysis
RulesMedium RiskAIHigh RiskIdentified as Google by our AI analysisAI analysisIdentical page
RulesMaliciousAIHigh Risk“Google” in the hostnameAI analysis
googleg1rs.com 2026-10-20RulesMaliciousAIHigh Risk“Google” in the hostnameAI analysis
RulesSuspicious — content hidden behind bot protectionAIHigh Riskuninspected“Google” in the hostnameAI analysis
RulesMedium RiskAIHigh RiskIdentified as Google by our AI analysisAI analysisIdentical page
RulesMedium RiskAIHigh RiskIdentified as Google by our AI analysisAI analysisIdentical page
RulesHigh RiskAIHigh RiskIdentified as Google by our AI analysisAI analysisIdentical page
RulesMedium RiskAIHigh RiskIdentified as Google by our AI analysisAI analysis
RulesLow RiskAIHigh RiskIdentified as Google by our AI analysisAI analysis
RulesLow RiskAIHigh RiskIdentified as Google by our AI analysisAI analysis
RulesHigh RiskAIHigh Risk“Google” in the hostnameAI analysis
RulesMedium RiskAIHigh RiskIdentified as Google by our AI analysisAI analysisIdentical page
RulesLow RiskAIModerate Risklower risk“Google” in the page titlePage text
RulesMaliciousAIConfirmed Scam“Google” in page or screenshot textScreenshot text
RulesMaliciousAIHigh Risk“Google” in the hostnameAI analysis
googley8rb.com 2026-10-18RulesMaliciousAIHigh Risk“Google” in the hostnameAI analysis
googlet0np.com 2026-10-18RulesMaliciousAIConfirmed Scam“Google” in the hostnameAI analysis
googles6yf.com 2026-10-18RulesMaliciousAIConfirmed Scam“Google” in the hostnameAI analysis
RulesMaliciousAIConfirmed ScamKnown Kit: Chinese-language fake software download sites (Google Chrome, WPS Office, QuickQ, Sunlogin) behind a search-engine cloak (cn-fake-software-seo-2026-10)“Google” in the hostnameAI analysis
RulesHigh RiskAIHigh Risk“Google” in the hostnameAI analysis
RulesMaliciousAIHigh RiskKnown Kit: Chinese-language fake software download sites (Google Chrome, WPS Office, QuickQ, Sunlogin) behind a search-engine cloak (cn-fake-software-seo-2026-10)“Google” in the hostnameAI analysis
RulesLow RiskAIHigh Risk“Google” in the hostnameAI analysis
RulesMaliciousAIHigh RiskKnown Kit: Chinese-language fake software download sites (Google Chrome, WPS Office, QuickQ, Sunlogin) behind a search-engine cloak (cn-fake-software-seo-2026-10)“Google” in the hostnameAI analysis
RulesMaliciousAIHigh RiskKnown Kit: Chinese-language fake software download sites (Google Chrome, WPS Office, QuickQ, Sunlogin) behind a search-engine cloak (cn-fake-software-seo-2026-10)“Google” in the hostnameAI analysis
RulesMaliciousAIHigh RiskKnown Kit: Chinese-language fake software download sites (Google Chrome, WPS Office, QuickQ, Sunlogin) behind a search-engine cloak (cn-fake-software-seo-2026-10)“Google” in the hostnameAI analysis
RulesLow RiskAIModerate Risklower risk“Google” in the hostnameAI analysis
RulesLow RiskAIModerate Risklower risk“Google” in the hostnameAI analysis
RulesLow RiskAIModerate Risklower risk“Google” in the hostnameAI analysis
RulesLow RiskAIModerate Risklower risk“Google” in the page titlePage text
RulesLow RiskAIModerate Risklower risk“Google” in the page titleAI analysisPage text
RulesLow RiskAIHigh Risk“Google” in the page titleAI analysis
RulesMaliciousAIConfirmed Scam“Google” in the hostnameAI analysis
RulesLow RiskAIModerate Risklower risk“Google” in the page titleAI analysis
RulesLow RiskAIModerate Risklower risk“Google” in the page titleAI analysis
RulesLow RiskAIHigh RiskIdentified as Google by our AI analysisAI analysis
RulesHigh RiskAIConfirmed ScamCredential Phishing on disposable hosting“Google” in the page titlePage text
RulesMaliciousAIHigh Risk“Google” in the hostnamePage text
RulesLow RiskAIHigh Risk“Google” in the page titleAI analysis
133 further sites are not listed at all: the Google name appeared on them, but we judged them not to be impersonation (both our rule engine and our AI analysis rated the page harmless, the page only mentions the brand, or it is a copy of another public website).