The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #130) that hxxps://teal-naiad-629295.netlify.app/ is a phishing page impersonating WeTransfer B.V., the Dutch file-sharing serv…
Source: x.com · published
The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #130) that hxxps://teal-naiad-629295.netlify.app/ is a phishing page impersonating WeTransfer B.V., the Dutch file-sharing service. netlify.app is a shared hosting domain; only this subdomain is reported here, and Netlify and WeTransfer are not the operators. Be wary of unexpected 'files shared with you' messages that ask you to sign in to an email or cloud account to download them.
Look-alike WeTransfer pages usually show up in emails or messages that say a file has been shared with you and ask you to sign in or enter an email password to download it. The address teal-naiad-629295.netlify.app is a page on shared Netlify hosting, not on wetransfer.com. Anything typed there can be used to take over an email or cloud account, and the promised file is often harmful or nothing at all.
Unexpected "files shared with you" notes are a standard lure. Open WeTransfer only by typing the official address yourself, and be cautious of any download page that asks for a mailbox password. Only this Netlify subdomain is reported here; Netlify and WeTransfer are not the operators. The alert comes from a public tracker post and has not been independently checked by scammers.com.
WeTransfer's official service does not need your email or cloud password in order to let you collect a file that was genuinely sent to you. If you are not expecting a transfer, confirm with the sender on a channel you already use before opening any download page.
Public post on X, 10 November 2026: https://x.com/TheThreatWire/status/2120048947460976739
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
A phishing page imitating German bank DKB was found on a path of arrondhevie.bj, the official site of a Benin district, according to a researcher. The district is not the operator.
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…