The Link Really Is google.com. The Page Is Still a Phishing Kit. (2026)

Verify inside your account — never via the email. The “Security alert” claiming an app password was just created leads to a page hosted on sites.google.com — a real Google domain where anyone can publish anything — dressed as a sign-in that harvests your Google and YouTube credentials. A real google.com URL only tells you who hosts the page, not who wrote it, and even a password manager's autofill is no proof of safety. The check that never fails: myaccount.google.com/notifications, typed yourself — if the alert isn't in your account, it didn't happen.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL free Read the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — October 6, 2026 →

Why you’re seeing this now

One X post passed five million views within days: a “Security alert” email, showing the sender [email protected], warning that an app password had just been created — “your account may be compromised” — above a blue “Check activity” button. The link opened a page on sites.google.com — a real Google domain where anyone with a Google account can publish anything — titled “google.com,” dressed with a fake “I'm not a robot” check, and ending at a credential-harvesting sign-in for the victim's Google and YouTube accounts. The trap's kicker: the user's password manager offered to autofill, because it had a legitimate login saved for sites.google.com. Two tells saved him: the layout differed from genuine Google alerts, and Gmail's “mailed-by” detail showed fwd.privateemail.com instead of Google. MEGA reconstructed the campaign on October 6; the technique has pedigree — April 2025's DKIM-replay subpoena phish, and Microsoft's September 2026 EvilTokens device-code wave tied to 12,000+ compromised inboxes. The check that never fails: myaccount.google.com/notifications, typed yourself. If the alert isn't in your account, it didn't happen.

Five red flags — any one is enough

An “app password created” or “new sign-in” alert pushing you to click and sign in.

The link leads to sites.google.com, Docs, or Forms — real Google account security lives only at myaccount.google.com and accounts.google.com.

Your password manager offers to autofill on a “Google” page that isn't accounts.google.com — autofill is not proof of safety.

“Your account may be compromised” urgency with a big blue button.

Gmail's mailed-by or signed-by lines name a forwarding service, not Google.

Your next three moves

Verify through a channel you open yourself — type myaccount.google.com/notifications into your browser and check your security notifications there. If the alert isn't inside your account, it didn't happen — no matter how real the sender address or the link looks.

Refuse the sign-in: no Google password typed into any page an email handed you — not even one on a real google.com address. Real account security lives only at myaccount.google.com and accounts.google.com; a “secure your account” page on sites.google.com, Docs, or Forms is the phishing kit.

Report the email as phishing in Gmail and at reportfraud.ftc.gov — and paste the message's link into the $2 instant check for a 0–100 scam risk score before you or anyone you forward it to signs in.

Can a phishing email really come from [email protected]?

Yes. Attackers have forwarded genuine Google notifications and abused Google's own infrastructure before (the April 2025 DKIM-replay attack). A real sender address alone proves nothing.

Is sites.google.com legitimate?

The domain is Google's, but anyone can publish a page there. A “secure your account” page on Google Sites is a red flag — real account security lives at myaccount.google.com.

I typed my password on one of these pages — now what?

Change it at myaccount.google.com (never via the email), review devices and recent security activity, remove app passwords you didn't create, turn on 2-Step Verification or a passkey, and change the password anywhere else you reused it.

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Spot the scam before it spots you.

For businesses · $19, one-time

Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $19

Free brand scan first — you only pay for the full audit.