BreachScout DomainSpoofBreachScout DomainSpoof

Is someone impersonating
your organization?

Find phishing reports linked to your organization. See who listed each domain and why we matched it.

Browse companiesHow it works →

Phishing reports

See each domain’s source report and company match.

Official domains & DNS

Compare matching hostnames with reviewed official domains and DNS checks.

Certificate matches Next

Coming later: brand matches from public certificate logs. A name match alone does not indicate abuse.

Reading a finding

Who reported it? Why did we match it?

Source reports and company matches are separate. Companies receive no overall danger score.

Was it reported as phishing?The named source’s claim and any dates it supplies.
Which brand was targeted?Our match, with its rule and confidence.
What infrastructure was observed?DNS and registration checks, dated separately.

Coverage

Current coverage

Counts from the latest validated source snapshots.

Source records
139,164
in latest validated snapshots
Distinct hostnames
109,585
after hostname normalization
Organizations matched
157
with published findings
Last successful snapshot
2026-10-19 22:09
UTC, across all sources
Recently listed names17,511names first found on an IP list in the last 24 h across 5,210 organizations · 5,758 names listed now
Most new listings:Coinbase 163Microsoft 160Binance 153Amazon 136Meta (Facebook) 128
Data feed and what a listing means → · updated 5 h ago

See source coverage and collection dates and the data feeds.

How it works

From a feed entry to a finding

  1. CollectDownload feeds every one to two hours.
  2. PrepareGroup related hostnames and redact URL parameters.
  3. MatchMatch companies by source label or brand name. Review ambiguous matches.
  4. Check DNSCheck DNS answers against IP lists.
  5. PublishShow permitted records. Accept free corrections.