The phishing-alert account @TheThreatWire posted on X on 11 November 2026 (Phishing Alert #134) that hxxps://taloha-fedex-shipping.vercel.app/ is a phishing page impersonating FedEx Corporation, the US express shippin…
Source: x.com · published
The phishing-alert account @TheThreatWire posted on X on 11 November 2026 (Phishing Alert #134) that hxxps://taloha-fedex-shipping.vercel.app/ is a phishing page impersonating FedEx Corporation, the US express shipping and parcel delivery company. vercel.app is a shared hosting domain; only this subdomain is reported here, and Vercel and FedEx are not the operators. Delivery lures typically ask for a small fee or card details to release or reschedule a parcel; track shipments only through the FedEx app or by typing fedex.com yourself.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
FedEx does not ask customers to release a parcel by signing in on a vercel.app page. Track a shipment only in the official FedEx app or by typing fedex.com yourself. Vercel is only the hosting platform; it is not the operator of taloha-fedex-shipping.vercel.app, and FedEx was impersonated and is not involved.
If a message about a FedEx delivery looks official but the link goes to a vercel.app page, treat it as hostile. Hover or long-press the link to read the hostname before you sign in, and remember that a familiar logo is not proof the page is FedEx.
Public post on X, 11 November 2026: https://x.com/TheThreatWire/status/2120535310119665690
The indicators come from this source and have not been independently checked by scammers.com.
The phishing-alert account @TheThreatWire posted on X on 12 November 2026 (Phishing Alert #140) that hxxps://voir-document.vercel.app/ is a phishing page impersonating Microsoft OneDrive. The domain also appears on th…
The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #129) that hxxps://amount-to-usdt-seven.vercel.app/ is a phishing page impersonating Trust Wallet, the cryptocurrency wallet. v…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…