Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that mail-premium-updatess[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's s…
Source: infosec.exchange · published
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that mail-premium-updatess[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot shows a page using mail.com branding and images with an email address and password form and a "Submit" button. mail.com is the brand being spoofed and is not involved. Email providers do not ask you to 'update' your account through pages on free website builders; sign in only at the provider's own site.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
mail-premium-updatess.weebly.com is a Weebly site, not mail.com. mail.com was impersonated and is not involved. A 'premium update' or storage-warning message is a common way to make a password request feel routine. Other Weebly-hosted login lures flagged the same day include fake WP Poczta pages and a fake ALEFPA sign-in. If you typed a mail.com password there, change it at mail.com and review forwarding rules and recent sign-ins.
Public post on Mastodon, 11 November 2026: https://infosec.exchange/@urldna/117596988574635815
The indicators come from this source and have not been independently checked by scammers.com.
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that ago-alefpa[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot s…
Anti-phishing project PhishDestroy posted on Mastodon on 11 November 2026 that wppoctza[.]weebly[.]com and wppkfkdpl[.]weebly[.]com are phishing detections. Its analysis pages say both show a minimal login form with a…
The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #131) that hxxps://sign-in-to-xfinity-3643.weebly.com/ is a phishing page impersonating Xfinity, the Comcast internet, TV and m…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
URL-analysis service urlDNA (@urldna@infosec.exchange) posted on Mastodon on 12 November 2026 that hxxps://rdkyle[.]wixsite[.]com/my-site is possible phishing. The screenshot it captured shows a Wix-built page reading…
Website scanning service ScanMalware posted on X on 12 November 2026 that chronos-reprieve-658a.s2506015[.]workers[.]dev is a confirmed scam. Its scan report describes a phishing kit imitating Meta's Privacy Center an…