Researcher @KesaGataMe0 flagged vvcc.yoga as a PayPay Bank phishing site that redirects to a fake login. PayPay Bank is not involved.
Source: x.com · published
On 9 November 2026 the phishing researcher @KesaGataMe0 posted on X that vvcc.yoga was hosting a phishing page impersonating PayPay Bank. The post said links of the form hxxps://vvcc[.]yoga/?id=... redirect to a fake login page at hxxps://vvcc[.]yoga/login, served behind Cloudflare (AS13335). The domain is not operated by PayPay Bank, and PayPay Bank is not involved.
Phishing pages like this are usually reached through a text message, email or search ad that claims there is a problem with an account, a payment or a delivery. The link opens a copy of the PayPay Bank sign-in or checkout screen on an address that has nothing to do with PayPay Bank. Anything typed into the form goes to whoever runs the page.
Criminals then use stolen logins to take over accounts, place orders or try the same password on other services, and card details can be used within minutes. Because the page can look almost identical to the real one, the safest check is the address bar: vvcc.yoga is not a PayPay Bank address.
Open PayPay Bank only through its official app. Anyone who entered details on vvcc.yoga should change the password through the official PayPay Bank app or website, enable two-step verification and contact their card issuer if payment details were entered. The indicators come from the post and have not been independently checked by scammers.com.
PayPay Bank will not ask you to open a login page through a random yoga domain. Treat any redirect from an unfamiliar host to a bank login as phishing, even if the final page looks polished.
Post by @KesaGataMe0 on X, 9 November 2026, flagging vvcc.yoga. Not independently verified by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
The OSINT account BeeSINT posted on Mastodon on 12 November 2026 a 'Phishing Spotlight' on facebook-profile-login[.]blogspot[.]com, built on Blogger, linking its analysis. The domain also appears on the Phishing Army…
Security researcher @catnap707 posted on X on 12 November 2026 about fake websites (偽サイト) impersonating the Tokyo Metropolitan Police Department (警視庁). The post lists the links jp[.]kdfz[.]net, jp[.]kstw[.]net, jp[.]k…