Anti-phishing project PhishDestroy posted on Mastodon on 11 November 2026 that wppoctza[.]weebly[.]com and wppkfkdpl[.]weebly[.]com are phishing detections. Its analysis pages say both show a minimal login form with a…
Source: mastodon.social · published
Anti-phishing project PhishDestroy posted on Mastodon on 11 November 2026 that wppoctza[.]weebly[.]com and wppkfkdpl[.]weebly[.]com are phishing detections. Its analysis pages say both show a minimal login form with a "WP poczta"-style logo (WP Poczta is a large Polish webmail service) asking for an email address and password ("Hasło"); 18 of 92 VirusTotal engines flagged each, and both are on the Phishing Army blocklist. WP and Weebly are the services being misused and are not involved. Log in to webmail only at the provider's own address, not on pages built with free site builders.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
wppoctza.weebly.com and wppkfkdpl.weebly.com are Weebly sites, not official WP Poczta or Wirtualna Polska mail pages. Wirtualna Polska was impersonated and is not involved. Other Weebly-hosted sign-in pages flagged the same day include a fake ALEFPA login at ago-alefpa.weebly.com and a fake mail.com 'premium update' page at mail-premium-updatess.weebly.com. Sign in to WP Poczta only through the official app or by typing the official address yourself.
Public post on Mastodon, 11 November 2026: https://mastodon.social/@phishdestroy/117597467287068779
The indicators come from this source and have not been independently checked by scammers.com.
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that mail-premium-updatess[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's s…
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that ago-alefpa[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot s…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…