Skip to content
Scammers.com
Social media & WhatsApp groupsReviewed

'Free Liker' site freeliker.net offering free Facebook likes flagged as phishing

Anti-phishing project PhishDestroy posted on Mastodon on 11 November 2026 that freeliker[.]net is a phishing detection. Its analysis page describes the site as "Free Liker", offering free Facebook likes, followers, re…

First reported
Reports
1

Source: mastodon.social · published

Illustration: Investing and crypto scams

What happened

Anti-phishing project PhishDestroy posted on Mastodon on 11 November 2026 that freeliker[.]net is a phishing detection. Its analysis page describes the site as "Free Liker", offering free Facebook likes, followers, reactions, comments and shares, with buttons to buy reactions, download a "Free Liker" app and sign in; 8 of 92 VirusTotal engines flagged it, and it is on the Phishing Army blocklist. Facebook is the platform named and is not involved. Free-likes services can require access to your Facebook account; never give your Facebook password or login token to third-party sites or apps.

How the scam works

Sites that offer free likes, followers or engagement usually ask you to sign in with a social account, install a browser extension or complete 'offers' that harvest passwords and payment details. freeliker.net was flagged as phishing by PhishDestroy. Facebook does not give away likes through a third-party 'Free Liker' site, and Facebook is not involved.

Do not grant a third-party site access to a Facebook account in exchange for likes. If you already signed in, change the password in the official app, review logged-in sessions and revoke any apps you do not recognise.

Offers of free engagement are a common way to take over social accounts or to enrol a visitor in paid 'offer walls'. Close the tab, and do not enter a Facebook password or a one-time code to 'unlock' likes.

Source

Public post on Mastodon, 11 November 2026: https://mastodon.social/@phishdestroy/117596790580281401

The indicators come from this source and have not been independently checked by scammers.com.

Red flags

  • A site that offers free Facebook likes, followers or engagement in exchange for a login or offer completion.
  • A request to sign in with Facebook or to grant app permissions on freeliker.net.
  • An 'offer wall' or survey that asks for payment details to unlock likes.
  • A promise of free engagement that Facebook itself does not sell that way.

If you were targeted

  1. 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
  2. 2Open the official Facebook app or type facebook.com yourself to check your account.
  3. 3If you entered details, change your password at once and contact the company through its official channels.
  4. 4Report the message and the link to the company and to your national reporting service.
  5. 5Delete the message without replying or tapping any links.

Fake Zerion crypto-wallet site zerion-inc.webflow.io flagged as phishing

Anti-phishing project PhishDestroy posted on Mastodon on 12 November 2026 that zerion-inc[.]webflow[.]io is a suspected phishing site. Its domain record shows a page copying Zerion's wallet homepage ("Crypto Wallet fo…

  • zerion-inc.webflow.io
  • Webflow subdomain; VirusTotal 17/92; URLScan brand: Zerion
  • Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)
Reported Nov 12, 20261 report
PhishingReviewed

Fake STP / SPEI login page at portal.stpmex.br.com flagged as phishing

The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…

  • portal.stpmex.br.com
  • Path /spei/login/; IP 217.151.99.216 (M247 Europe, AS9009, Romania)
Reported Nov 12, 20261 report

MalwareTips: household-goods store deniudy.com in scam network, flagged by 5 VirusTotal vendors

MalwareTips published an investigation today rating deniudy.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new na…

  • deniudy.com
  • Part of a scam network of near-identical dropshipping stores (MalwareTips)
  • MalwareTips fake or copycat store cluster (12 Nov 2026)
Reported Nov 12, 20261 report

MalwareTips: candy store thebakedbox.in in scam network, flagged by 5 VirusTotal vendors

MalwareTips published an investigation today rating thebakedbox.in a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…

  • thebakedbox.in
  • Part of a scam network of near-identical dropshipping stores (MalwareTips)
  • MalwareTips fake or copycat store cluster (12 Nov 2026)
Reported Nov 12, 20261 report

MalwareTips: grace-bags.com scam-network bag store flagged by 11 VirusTotal vendors

MalwareTips published an investigation today rating grace-bags.com a high-risk store that belongs to a scam network of near-identical shops sharing templates, product photos and return policies and reopening under new…

  • grace-bags.com
  • Part of a scam network of near-identical dropshipping stores (MalwareTips)
  • MalwareTips fake or copycat store cluster (12 Nov 2026)
Reported Nov 12, 20261 report

Wexford Advisory clone flagged again by Spain's CNMV on new domain; MalwareTips finds 14% 'fund release' fee notice

MalwareTips published an investigation today into the 'Wexford Advisory' crypto and stock trading site. It reports that Spain's securities regulator, the CNMV, lists the name twice as a clone: an October 19, 2026 entr…

  • market.wexford-advisory.limited
  • Earlier clone domain wexfordadvisory-ltd.com (CNMV Oct 19); back end pro-simp-pd.com per MalwareTips
  • Unauthorised / AI-trading investment sites flagged 12 Nov 2026
Reported Nov 12, 20261 report