Japanese threat-intelligence account Metemcyber posted on X on 11 November 2026, crediting the researcher team NA4Sec, a phishing site at hxxps://nuvexalora[.]cfd/drgsdfbdr/#/index posing as the customer login page of…
Source: x.com · published
Japanese threat-intelligence account Metemcyber posted on X on 11 November 2026, crediting the researcher team NA4Sec, a phishing site at hxxps://nuvexalora[.]cfd/drgsdfbdr/#/index posing as the customer login page of Matsui Securities (松井証券), hosted at IP 8.211.162[.]242 (AS45102). The screenshot it shared shows a copy of the broker's "お客様サイト ログイン" page asking for a login ID and password. It is on the same IP as orvexilium[.]cfd, another Matsui Securities phishing domain Metemcyber reported earlier the same morning. Matsui Securities is the brand being spoofed and is not involved. Log in to brokerage accounts only through the official app or a bookmarked address, never through links in emails or texts.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
The page at nuvexalora.cfd, on the path /drgsdfbdr/#/index, copies a Matsui Securities customer login form. Matsui Securities was impersonated and is not involved. The same research team also flagged orvexilium.cfd on the same IP address, 8.211.162.242, with the same path. Sign in to Matsui only through the official site or app you already use.
Public post on X, 11 November 2026: https://x.com/Metemcyber/status/2120416015012319322
The indicators come from this source and have not been independently checked by scammers.com.
The Metemcyber account posted on X on 11 November 2026, with credit to Team NA4Sec, a phishing site targeting Japan that impersonates Matsui Securities (松井証券), the Japanese online brokerage, at hxxps://orvexilium[.]cf…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…