The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #132) that hxxps://brtzknv.eu[.]cc/IT/ is a phishing page impersonating BRT S.p.A., the Italian parcel courier that is part of…
Source: x.com · published
The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #132) that hxxps://brtzknv.eu[.]cc/IT/ is a phishing page impersonating BRT S.p.A., the Italian parcel courier that is part of Geopost Group, aimed at users in Italy. BRT is spoofed and is not the operator. Parcel delivery lures typically ask for a small fee or card details to release or reschedule a package; check shipments only through the courier's official app or website typed yourself.
Parcel-delivery look-alike pages aimed at Italy commonly arrive as texts or emails that say a BRT shipment is waiting, has a customs fee, or must be rescheduled, and then ask for a card payment or personal details to release the parcel. The address brtzknv.eu.cc is not an official BRT or Geopost site. Card numbers and identity details entered there can be used for fraud, and there is often no parcel at all.
Check a shipment only in the courier's official app or by typing the official website yourself, using a tracking number you already have from the sender. BRT is spoofed and is not the operator of this page. The alert comes from a public tracker post and has not been independently checked by scammers.com.
Couriers in Italy, including BRT, already have the tracking number on an official site or app if a parcel is real. A message that will not let you view the shipment without paying a fee first is a common delivery lure.
Public post on X, 10 November 2026: https://x.com/TheThreatWire/status/2120170556586852633
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
A phishing page imitating German bank DKB was found on a path of arrondhevie.bj, the official site of a Benin district, according to a researcher. The district is not the operator.
The phishing-alert account @TheThreatWire posted on X on 12 November 2026 (Phishing Alert #140) that hxxps://voir-document.vercel.app/ is a phishing page impersonating Microsoft OneDrive. The domain also appears on th…