The urlDNA scanning service posted on Mastodon on 12 November 2026 that hxxp://office365licensingsupport.com is a possible phishing page, linking its scan. The domain also appears on the Phishing Army extended blockli…
Source: infosec.exchange · published
The urlDNA scanning service posted on Mastodon on 12 November 2026 that hxxp://office365licensingsupport.com is a possible phishing page, linking its scan. The domain also appears on the Phishing Army extended blocklist, a public phishing domain blocklist. The domain uses the Office 365 name but is not a Microsoft domain; Microsoft is not the operator. Manage Microsoft 365 licenses only through admin.microsoft.com or your organization's IT team, and do not call support numbers or sign in from unsolicited messages. Source: https://infosec.exchange/@urldna/117602059339295608
These pages copy a familiar login, payment or delivery form so that a typed password, one-time code, card number or other personal detail goes to the operator rather than to the real company. The address is often a look-alike domain, a newly registered shop, or a free host such as Weebly, Wix, Firebase, Vercel, Workers or Pages. Some kits cloak the real form from scanners and only show it in certain countries or to certain devices. The brand whose name or logo appears is being impersonated and is not involved, unless the report says the page was planted on a compromised official site, in which case only that path is the phishing lure. Open the official app or type the company's real address yourself. If you already entered a password or a card number, change the password on the official site, turn on a new two-factor method, and contact the company and your bank.
If a message, a page or a caller creates urgency about money, a login or a legal threat, pause and check the claim through a contact method you already trust. Keep screenshots, reference numbers and the exact addresses or phone numbers you were given, and tell your bank early if money has already left the account. Official brands and authorised firms named in a lure are not involved unless a primary source says otherwise.
The urlDNA scanning service posted on Mastodon on 12 November 2026 that hxxp://outlookmail.social is a possible phishing page, linking its scan. The domain also appears on the Phishing Army extended blocklist, a publi…
The phishing-alert account @TheThreatWire posted on X on 12 November 2026 (Phishing Alert #140) that hxxps://voir-document.vercel.app/ is a phishing page impersonating Microsoft OneDrive. The domain also appears on th…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…