phishunt.io flags Google account phishing site mail-googleaccounts-verification.uw.ua
phishunt.io flagged mail-googleaccounts-verification.uw.ua on 31 October 2026 as a phishing page that imitates Google's sign-in screen. Google is not involved; the domain is not Google's.
- First reported
- Reports
- 1
Source: x.com · published
What happened
phishunt.io, an automated phishing-detection feed, posted on X on 31 October 2026 that it had detected a phishing site impersonating Google at mail-googleaccounts-verification.uw.ua. The post lists the site's IP address as 69.46.46.90, hosted on the Railway cloud platform (AS400940) in the United States, and links to the feed's page on suspicious Google lookalikes. Google is not involved: the address is not a Google domain.
How the scam works
The screenshot attached to the post shows a page that imitates Google's sign-in screen. It has a “Sign in” heading, the text “To continue to Gmail, sign in to your Google Account”, an “Email or phone” field and a blue “Next” button. A page like this is built to capture whatever the visitor types, usually the account email address or phone number first, followed by the password and any verification code on the next screen. With those details an attacker can read mail, reset other accounts and impersonate the victim to their contacts.
The web address is the main giveaway. It begins with “mail-googleaccounts-verification” to look like an official verification page, but the part that counts is the end of the domain, uw.ua, which belongs to a Ukrainian domain space and has nothing to do with Google. Genuine Google sign-in pages are on accounts.google.com. Phishers often add words such as “verification”, “accounts” or “mail” to a lookalike name so that the address looks official on a small phone screen.
On 31 October 2026 scammers.com checked the Phishing Army blocklist and found mail-googleaccounts-verification.uw.ua listed. A blocklist entry is a warning flag, not a court finding.
Source
phishunt.io post on X, 31 October 2026 (screenshot and indicators), with the domain's Phishing Army blocklist status checked by scammers.com the same day.
Red flags
- A Google sign-in page on a domain that is not accounts.google.com, here mail-googleaccounts-verification.uw.ua.
- A web address padded with words like “verification”, “accounts” or “mail” to look official.
- A message telling you to verify your Google account or mailbox by following a link.
- A sign-in page reached from an email or text rather than by typing the address yourself.
- A page that asks for your password and codes before showing any account content.
If you were targeted
- 1Do not enter your email, phone number or password on mail-googleaccounts-verification.uw.ua.
- 2If you did, change your Google password straight away from the official site and sign out of other sessions.
- 3Turn on 2-Step Verification, ideally with a passkey or security key.
- 4Check Google's Security page for unfamiliar devices or recovery changes.
- 5Go to Google only by typing the address or using the app, and report phishing messages to Google.