Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that hxxps://pub-f2ec4aa4192d4950abc21ae9510403d4[.]r2[.]dev/still[.]html is a possible phishing page; the host is also on the Phi…
Source: infosec.exchange · published
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that hxxps://pub-f2ec4aa4192d4950abc21ae9510403d4[.]r2[.]dev/still[.]html is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot shows a page imitating a cPanel webmail login with the message "Your session cookie is invalid. Please log in again" and fields for an email address and email password. cPanel and Cloudflare are the services being misused and are not involved. If an email link says your mail session expired, go to your webmail directly instead of using the link.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
The page is hosted on a Cloudflare R2 bucket at pub-f2ec4aa4192d4950abc21ae9510403d4.r2.dev/still.html and copies a cPanel-style webmail login, including a 'session cookie is invalid' message. cPanel and Cloudflare were not the operators of this lure; a genuine host will not ask you to re-enter a mailbox password on a random r2.dev address. If you typed a password there, change it at the real mail host and at any other site that reused it, and review forwarding rules.
Public post on Mastodon, 11 November 2026: https://infosec.exchange/@urldna/117598756242284905
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that naciomverificar-7mqh[.]vercel[.]app is a confirmed scam. Its scan report says the page claims to be "Banco de la Nación - Multired Virtual", the online banking of Peru'…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
URL-analysis service urlDNA (@urldna@infosec.exchange) posted on Mastodon on 12 November 2026 that hxxps://rdkyle[.]wixsite[.]com/my-site is possible phishing. The screenshot it captured shows a Wix-built page reading…