Skip to content
Scammers.com
PhishingReviewed

Fake SAPO Mail login page on login-sapomail-pt.weebly.com

CyberPulse reported a fake SAPO Mail login page at login-sapomail-pt.weebly.com that tries to collect Portuguese users' emails, phone numbers and passwords.

First reported
Reports
1

Source: x.com · published

Illustration: Phishing, texts and email scams

What happened

In a phishing alert posted on X on October 13, 2026, CyberPulse (@CyberPulse56) reported a fake login page impersonating SAPO Mail, a Portuguese email service, at login-sapomail-pt.weebly.com.

The post said the page tries to trick users into entering their email addresses, phone numbers and passwords. It said 5 of 93 security vendors flagged the URL as malicious and that it was served from IP 74.115.51.9 in the United States. The free website builder Weebly was abused to host it; SAPO and Weebly were not involved.

How the scam works

Email-account phishing typically arrives as a message saying your mailbox is full, your account will be closed, or you must verify your details. The link leads to a page made with a free website builder that copies the provider's login screen. Stolen email logins are valuable because they can be used to reset passwords for other accounts, send further scams to your contacts, or read sensitive messages.

Note: this report is based on a short public post on X. The "How the scam works" section describes how this type of scam generally operates; it does not add details about this specific site beyond what the post says.

Source

CyberPulse (@CyberPulse56) on X, October 13, 2026.

Red flags

  • An email login page hosted on a free site builder (weebly.com) instead of the provider's own domain.
  • Messages warning that your mailbox will be closed or is over quota.
  • Being asked for your phone number along with your password.

If you were targeted

  1. 1Do not enter a password, card number or one-time code on the page.
  2. 2If you already did, change that password right away (and anywhere you reused it), turn on two-step verification, and call your bank or card issuer if you entered payment details.
  3. 3Go to the real service by typing its address yourself or using its official app, not by following a link.
  4. 4Report the message to the impersonated company and to your national fraud or cybercrime reporting service.
ReportFraud.ftc.gov FBI IC3 More resources