The phishing-alert account @TheThreatWire posted on X on 11 November 2026 (Phishing Alert #133) that hxxps://digitalbo.netlify.app/gananet is a phishing page impersonating Gananet S.r.l., an Italian IT, cloud and Micr…
Source: x.com · published
The phishing-alert account @TheThreatWire posted on X on 11 November 2026 (Phishing Alert #133) that hxxps://digitalbo.netlify.app/gananet is a phishing page impersonating Gananet S.r.l., an Italian IT, cloud and Microsoft 365 services company. netlify.app is a shared hosting domain; only this subdomain is reported here, and Netlify and Gananet are not the operators. Be cautious of messages that send you to a page asking you to sign in to a work email or Microsoft 365 account.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
Gananet S.r.l. does not send customers to a netlify.app path to sign in to email or Microsoft 365. Netlify is only the hosting platform; it is not the operator of digitalbo.netlify.app, and Gananet was impersonated and is not involved. If a message about a work account used that address, close it and sign in only through the official app or a typed official site.
Public post on X, 11 November 2026: https://x.com/TheThreatWire/status/2120531314327834847
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
A phishing page imitating German bank DKB was found on a path of arrondhevie.bj, the official site of a Benin district, according to a researcher. The district is not the operator.
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…