Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that ago-alefpa[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot s…
Source: infosec.exchange · published
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that ago-alefpa[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot shows a French-language "Se connecter" form under the logo of ALEFPA, a French social-care and education association, asking for an email address and password. ALEFPA is the organisation being spoofed and is not involved, and Weebly is the site builder being misused. Staff and partners should sign in only through addresses they know belong to their organisation.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
ago-alefpa.weebly.com is a Weebly site, not an official ALEFPA sign-in page. ALEFPA was impersonated and is not involved. Other Weebly-hosted login lures flagged the same day include fake WP Poczta pages and a fake mail.com 'premium update' page. Sign in only through the official site or app you already use.
Public post on Mastodon, 11 November 2026: https://infosec.exchange/@urldna/117598286167444285
The indicators come from this source and have not been independently checked by scammers.com.
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that mail-premium-updatess[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's s…
The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #131) that hxxps://sign-in-to-xfinity-3643.weebly.com/ is a phishing page impersonating Xfinity, the Comcast internet, TV and m…
Anti-phishing project PhishDestroy posted on Mastodon on 11 November 2026 that wppoctza[.]weebly[.]com and wppkfkdpl[.]weebly[.]com are phishing detections. Its analysis pages say both show a minimal login form with a…
ScanMalware posted on X on 12 November 2026 that naciomverificar-7mqh[.]vercel[.]app is a confirmed scam. Its scan report says the page claims to be "Banco de la Nación - Multired Virtual", the online banking of Peru'…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
URL-analysis service urlDNA (@urldna@infosec.exchange) posted on Mastodon on 12 November 2026 that hxxps://rdkyle[.]wixsite[.]com/my-site is possible phishing. The screenshot it captured shows a Wix-built page reading…