The Metemcyber account posted on X on 11 November 2026, with credit to Team NA4Sec, a phishing site targeting Japan that impersonates Amazon at hxxps://48c9be.av68[.]site/, hosted at IP 47.79.37.250 (ASN AS45102). The…
Source: x.com · published
The Metemcyber account posted on X on 11 November 2026, with credit to Team NA4Sec, a phishing site targeting Japan that impersonates Amazon at hxxps://48c9be.av68[.]site/, hosted at IP 47.79.37.250 (ASN AS45102). The site is not operated by Amazon. Check your Amazon account only through the app or by typing amazon.co.jp yourself, and do not sign in from links in emails or texts.
Pages that copy a familiar sign-in form are usually reached from an email, text, advert, comment or search result that warns of a problem with an account, a delivery or a payment. The form looks official, but anything typed — a password, a one-time code or a wallet recovery phrase — goes to whoever set up the page rather than to the real company. Those details can be used at once to take over the account, change the recovery email or empty a wallet.
Amazon does not use 48c9be.av68.site as a sign-in or order page. Amazon was impersonated and is not involved. The host IP listed in the research post sits on AS45102 address space; that is the infrastructure, not Amazon. Check an order only in the official Amazon app or by typing amazon.co.jp yourself.
If a message about an Amazon order looks official but the link does not go to amazon.co.jp, treat it as hostile. Hover or long-press the link to read the hostname before signing in.
Public post on X, 11 November 2026: https://x.com/Metemcyber/status/2120448286301774071
The indicators come from this source and have not been independently checked by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
URL-analysis service urlDNA (@urldna@infosec.exchange) posted on Mastodon on 12 November 2026 that hxxps://rdkyle[.]wixsite[.]com/my-site is possible phishing. The screenshot it captured shows a Wix-built page reading…