Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that instagram-tip[.]blogspot[.]com is a possible phishing page, and the OSINT account BeeSINT listed the same address in a "Phish…
Source: infosec.exchange · published
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 10 November 2026 that instagram-tip[.]blogspot[.]com is a possible phishing page, and the OSINT account BeeSINT listed the same address in a "Phishing Spotlight" post at 4:00 AM ET (https://mastodon.social/@BeeSINT/117591325489282822). The page is on the Phishing Army blocklist. urlDNA also flagged instagram-analytics[.]blogspot[.]com at 11:00 AM ET (https://infosec.exchange/@urldna/117592975997270199). These are Blogger pages using Instagram's name; Instagram, Meta and Blogger are not the scammers. Log in to Instagram only through the app or by typing instagram.com.
urlDNA flagged instagram-tip.blogspot.com as a possible phishing page, and the OSINT account BeeSINT listed the same address in a Phishing Spotlight post. urlDNA also flagged instagram-analytics.blogspot.com the same day. The page is on the Phishing Army blocklist.
Blogger and other free site builders are often used for look-alike login pages because a page can be published in minutes under a name that includes a well-known brand. The login or "notification" form is not run by the brand whose name appears in the address. Passwords and one-time codes entered there are sent to whoever created the page and can be used at once to take over the real account.
Meta, Instagram, Facebook and Google's Blogger service are not the operators of these pages. Meta does not send account warnings through blogspot.com addresses. Sign in only through the official app or by typing the official website yourself. The flags come from automated scanners and public blocklists and have not been independently checked by scammers.com.
Public post on Mastodon, 10 November 2026: https://infosec.exchange/@urldna/117590970449837864
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
Anti-phishing project PhishDestroy posted on Mastodon on 12 November 2026 that zerion-inc[.]webflow[.]io is a suspected phishing site. Its domain record shows a page copying Zerion's wallet homepage ("Crypto Wallet fo…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…