The BeeSINT threat-intelligence account posted on Mastodon on 11 November 2026 a 'Phishing Spotlight' on www.facebook-verification-system3.blogspot.com. The domain also appears on the Phishing Army extended blocklist,…
Source: mastodon.social · published
The BeeSINT threat-intelligence account posted on Mastodon on 11 November 2026 a 'Phishing Spotlight' on www.facebook-verification-system3.blogspot.com. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. blogspot.com is Google's shared blog-hosting domain; only this blog is reported here, and Google and Meta are not the operators. Facebook does not ask users to verify accounts through blog pages; ignore messages threatening account suspension and check your account only in the official app.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
facebook-verification-system3.blogspot.com is a Blogger site, not an official Facebook verification system. Facebook and Meta were impersonated and are not involved. A second Facebook-themed Blogger page, facebook-account-login-page.blogspot.com, was flagged the same day. A message about a disabled account or a security check that sends you to Blogspot is a common account-takeover lure.
A 'verification system' on Blogspot is not a Facebook security process. If you already typed a password there, change it in the official app and review logged-in sessions and authorised apps.
Public post on Mastodon, 11 November 2026: https://mastodon.social/@BeeSINT/117596989169780076
The indicators come from this source and have not been independently checked by scammers.com.
The urlDNA scanning service posted on Mastodon on 11 November 2026 that hxxp://www.facebook-account-login-page.blogspot.com/ is a possible phishing page, linking its scan. The domain also appears on the Phishing Army…
Website scanning service ScanMalware posted on X on 12 November 2026 that chronos-reprieve-658a.s2506015[.]workers[.]dev is a confirmed scam. Its scan report describes a phishing kit imitating Meta's Privacy Center an…
The OSINT account BeeSINT posted on Mastodon on 12 November 2026 a 'Phishing Spotlight' on facebook-profile-login[.]blogspot[.]com, built on Blogger, linking its analysis. The domain also appears on the Phishing Army…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…