@TheThreatWire flagged validate-verify.vercel.app/login as a Facebook phishing page. Meta and Vercel are not involved.
Source: x.com · published
On 9 November 2026 the phishing-alert account @TheThreatWire posted on X that validate-verify.vercel.app was hosting a phishing page impersonating Facebook (Meta Platforms). In Phishing Alert #128 the post said hxxps://validate-verify.vercel.app/login is a phishing page. The same host also appears on the Phishing Army blocklist. vercel.app is a shared hosting domain; only this subdomain is reported, and Vercel is not the operator. The domain is not operated by Facebook (Meta Platforms), and Facebook (Meta Platforms) is not involved.
Phishing pages like this are usually reached through a text message, email or search ad that claims there is a problem with an account, a payment or a delivery. The link opens a copy of the Facebook (Meta Platforms) sign-in or checkout screen on an address that has nothing to do with Facebook (Meta Platforms). Anything typed into the form goes to whoever runs the page.
Criminals then use stolen logins to take over accounts, place orders or try the same password on other services, and card details can be used within minutes. Because the page can look almost identical to the real one, the safest check is the address bar: validate-verify.vercel.app is not a Facebook (Meta Platforms) address.
Facebook account warnings should be checked only in the Facebook app or by typing facebook.com yourself. Anyone who entered details on validate-verify.vercel.app should change the password through the official Facebook (Meta Platforms) app or website, enable two-step verification and contact their card issuer if payment details were entered. The indicators come from the post and have not been independently checked by scammers.com.
Post by @TheThreatWire on X, 9 November 2026, flagging validate-verify.vercel.app. Not independently verified by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
The OSINT account BeeSINT posted on Mastodon on 12 November 2026 a 'Phishing Spotlight' on facebook-profile-login[.]blogspot[.]com, built on Blogger, linking its analysis. The domain also appears on the Phishing Army…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…