The fake Apple, Microsoft, and Google sign-in pages are getting better — here's the one thing to check

Here's an uncomfortable fact about the fake login pages that steal passwords: the newest ones don't look fake at all. The logo is right. The layout is right. The colors, the fonts, the little "Forgot password?" link — all right. The one thing that isn't right is the domain in the address bar, and that's the only thing worth checking.

Five brands, more than half the phishing

You'd think scammers would spread their fake pages across hundreds of brands. They don't. They cluster on the handful of accounts almost everyone has and logs into constantly.

In its Q2 2026 Brand Phishing Report (published July 2026), security firm Check Point ranked the brands that phishing pages impersonate most. The top of the list is exactly the set of logins you use every week:

Add the top five together and you pass the halfway mark: Check Point states it plainly — the top five brands accounted for more than half of all brand phishing activity tracked in the quarter. Half of everything, aimed at five accounts you almost certainly own. (A sign of the times: OpenAI's ChatGPT entered the top ten for the first time this quarter.)

"Just look for the fake logo" stopped working

The old advice was to look for tells: a blurry logo, clumsy English, a layout that's slightly off. That advice is aging fast, because the attackers stopped building imitations and started serving the real thing.

IT Pro reported on a phishing kit — sold as a subscription, of all things — that reverse-proxies the genuine, live login pages of Microsoft, Google, Apple, and others. In plain terms: the scam page doesn't copy Google's sign-in screen. It quietly relays the actual Google sign-in screen to you, sitting invisibly in the middle, passing your keystrokes through and pocketing them on the way.

Because you're looking at the real page content, the usual visual warning signs vanish. There's no blurry logo to catch, no typo to notice. Worse, sitting in the middle lets these kits capture the one-time code from your authenticator app as you type it — so even two-factor login can be defeated in the moment.

The one thing to check: the real domain

Every login page lives at a web address, and that address is the one detail the attacker cannot borrow. Microsoft's sign-in genuinely lives on Microsoft's domains. Google's lives on Google's. A relay-in-the-middle page, no matter how perfect it looks, has to live somewhere else — on a domain its owner registered.

So the check is simple to say: before you type a password, read the domain and ask whether it really belongs to the brand. The trick is reading the domain correctly, because that's exactly where the scam hides.

Find the real domain in three steps

1. Look at the address bar, not the page. The page can say "Sign in to Microsoft." That's just text on a page — anyone can write it. Only the address bar reports where you actually are.
2. Read the web address right to left. The real domain is the last two chunks before the first single slash. In login.microsoftonline.com/account, the real owner is microsoftonline.com. Everything to the left (login.) is just a label the owner chose.
3. Distrust anything glued on with dots or dashes. microsoft.com-verify-login.info is not Microsoft. Read it right to left and the real owner is com-verify-login.info. The word "microsoft" is bait pasted on the front.

The other flavor of this trick is the letter swap: app1e.com with a number 1, or micros0ft.com with a zero. Your eye reads the word-shape and glides past the swap. If you want the full tour of that particular con, we wrote it up in the letter-swap trick your eyes can't catch.

How IP Tracker does this check for you

IP Tracker is a free Chrome extension. Copy the web address of a login page (or the sender's address from a "verify your account" email) and paste it into the popup. The free tier gives you 25 checks a day, with no account and no tracking. Only the value you paste is looked up.

For a domain, it does the reading-right-to-left work automatically, then checks the base domain against the official domains of more than 120 widely impersonated brands — Microsoft, Apple, Google, and Amazon among them. It normalizes look-alike characters (the number 1 and capital I become a lowercase l, zero becomes the letter O, common Cyrillic look-alikes map back to Latin) before comparing, so a swap like app1e.com gets caught even though your eye missed it.

An exact match to a real brand domain gets a "verified" note. A match only after normalizing look-alike characters is flagged HIGH, with a banner naming the trick. A near-miss spelling that uses no look-alike characters is flagged as a MEDIUM "possible lookalike." Alongside that, it shows whether Google Safe Browsing (Google's list of reported dangerous sites) has flagged the address, how many security vendors flag it on VirusTotal, community abuse reports, and how recently the domain was registered — because a brand-new domain wearing a big brand's name is a classic phishing signature.

What it can't do

Honesty matters more than comfort here, so four limits worth knowing:

• It reads the domain; it can't read your screen. IP Tracker checks a domain you paste in. It doesn't watch the page you're on or click anything for you. You still have to copy the real address over to it.
• The brand list is about 120 brands. The most impersonated ones — which does include the big names above — but not every brand on earth. A lookalike of your regional bank or a niche service may not be on it.
• Blocklists lag. Google Safe Browsing is strong on known bad sites, but a fake page spun up an hour ago may not be reported and listed yet. "Nothing found" on a fresh domain is thin comfort — see why a brand-new domain is a warning, not an all-clear.
• A relay-in-the-middle page still lives on a wrong domain. That's the good news — the domain check still applies. But the tool can only flag the address you bring it. If you never look at the address, no tool can look for you.

The fake login pages have gotten good enough that the page itself can lie to you convincingly. The web address can't. When a message pushes you to "sign in and verify" right now, slow down for five seconds, read the domain right to left, and make sure the owner is really who the page claims to be — or paste it in and let the check run for you.

To summarize:

• ✓ Over half of all brand phishing targets five logins: Microsoft, LinkedIn, Google, Apple, Amazon.
• ✓ The newest fakes relay the real page, so the page can't tell you it's fake.
• ✓ Read the web address right to left; the real owner is the last two chunks before the first slash.
• ✓ Distrust a brand name glued on with dots or dashes, and watch for 1-for-l and 0-for-o swaps.
• ✓ Or paste the address into IP Tracker and let it name the trick for you.

Stay sharp! 😎