Security researcher @masaomi346 posted on X on 10 November 2026 a phishing site impersonating Amazon at hxxps://aniv.bpovexd[.]cn/t10ijauryj, tagged #Phishing and #フィッシング詐欺. The site is not operated by Amazon. Do not…
Source: x.com · published
Security researcher @masaomi346 posted on X on 10 November 2026 a phishing site impersonating Amazon at hxxps://aniv.bpovexd[.]cn/t10ijauryj, tagged #Phishing and #フィッシング詐欺. The site is not operated by Amazon. Do not sign in or enter card details from links in emails or texts claiming to be from Amazon; open the Amazon app or type amazon.co.jp yourself to check your account.
Amazon-branded look-alike pages commonly arrive in emails or texts that warn of a failed payment, a delivery problem or a locked account and push a button to sign in. The address aniv.bpovexd.cn is not amazon.co.jp or any other official Amazon host. Details entered on that page, including passwords and card numbers, go to the person who put the page up.
Amazon will not ask you to sign in through a link in an unexpected message. Open the official Amazon app or type amazon.co.jp yourself if you need to check an order. Japanese-language Amazon lures often use a .cn or otherwise unrelated hostname with an Amazon-looking path, which is a strong sign the page is not genuine. The report comes from a researcher's public post and has not been independently checked by scammers.com.
If a message about an Amazon order looks official but the link does not go to amazon.co.jp, treat it as hostile. Hover or long-press the link to read the hostname before signing in, and remember that a familiar logo is not proof the page is Amazon's.
Public post on X, 10 November 2026: https://x.com/masaomi346/status/2120106506867949787
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…