Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that info-facebook[.]blogspot[.]com is a possible phishing page, and earlier the same day flagged facebook-notification[.]blogspot…
Source: infosec.exchange · published
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that info-facebook[.]blogspot[.]com is a possible phishing page, and earlier the same day flagged facebook-notification[.]blogspot[.]com (7:30 AM ET, https://infosec.exchange/@urldna/117592150083730594) and facebook-developers[.]blogspot[.]com (5:00 AM ET, https://infosec.exchange/@urldna/117591562376521824). All three are on the Phishing Army blocklist, and info-facebook[.]blogspot[.]com is also in OpenPhish's public feed. They are pages on Google's Blogger service using Facebook's name; Facebook, Meta and Blogger are not the scammers. Meta does not send account warnings through blogspot.com pages, so never enter your Facebook password or login codes there.
urlDNA flagged info-facebook.blogspot.com, facebook-notification.blogspot.com and facebook-developers.blogspot.com as possible phishing pages. All three are on the Phishing Army blocklist, and info-facebook.blogspot.com is also in OpenPhish's public feed.
Blogger and other free site builders are often used for look-alike login pages because a page can be published in minutes under a name that includes a well-known brand. The login or "notification" form is not run by the brand whose name appears in the address. Passwords and one-time codes entered there are sent to whoever created the page and can be used at once to take over the real account.
Meta, Instagram, Facebook and Google's Blogger service are not the operators of these pages. Meta does not send account warnings through blogspot.com addresses. Sign in only through the official app or by typing the official website yourself. The flags come from automated scanners and public blocklists and have not been independently checked by scammers.com.
Public post on Mastodon, 10 November 2026: https://infosec.exchange/@urldna/117592741996527140
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
ScanMalware posted on X on 12 November 2026 that ralka-devon-biz-qenmar-soltek-sp9ct12[.]pages[.]dev is a confirmed scam. Its scan report says the page at /form_submit_appeal/ matches a known "Meta Page Appeal" phishi…