Phishing tracker @phishunt_io posted on X on 10 November 2026 that instagram-services[.]com is an Instagram-themed phishing site. The post listed the host IP as 216.150.1.1 on Amazon (AS16509) in the United States and…
Source: x.com · published
Phishing tracker @phishunt_io posted on X on 10 November 2026 that instagram-services[.]com is an Instagram-themed phishing site. The post listed the host IP as 216.150.1.1 on Amazon (AS16509) in the United States and linked it from phishunt.io's tracker. The domain is not an official Instagram or Meta address. Sign in to Instagram only through the official app or by typing instagram.com yourself, and never enter your password or a login code on a page reached from a message or ad.
Pages that copy Instagram's sign-in form are usually reached from direct messages, comments, ads or emails that claim a login problem, a copyright strike or a chance to recover a disabled account. The form looks familiar, but anything typed is sent to whoever runs instagram-services.com rather than to Meta. A captured password and a one-time login code can be used immediately to take over the account, change the recovery email and lock the real owner out.
Instagram's real sign-in address is instagram.com, and the official app does not send customers to a separate "services" domain. The host IP listed in the tracker post sits on Amazon address space, which many throwaway sites use; Amazon is the infrastructure provider, not the operator of the page. Because the report comes from a public tracker post, the indicators have not been independently checked by scammers.com.
Public post on X, 10 November 2026: https://x.com/phishunt_io/status/2120064154929127855
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
The OSINT account BeeSINT posted on Mastodon on 12 November 2026 a 'Phishing Spotlight' on facebook-profile-login[.]blogspot[.]com, built on Blogger, linking its analysis. The domain also appears on the Phishing Army…
The phishing feed @PhishStats posted on X on 12 November 2026 a new phishing URL, hXXps://portal[.]stpmex[.]br[.]com/spei/login/, hosted at 217.151.99.216 (M247 Europe SRL, AS9009, Romania). The hostname and path use…
Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…