Search results

3 reports for “Phishing kit exfiltrating to a Telegram bot (12 Nov 2026)”

Searched by keyword.

Wallet-drainer page multi-xchange.firebaseapp.com poses as WalletLink connection service

ScanMalware posted on X on 12 November 2026 that multi-xchange[.]firebaseapp[.]com is a confirmed scam. Its scan report describes a wallet-drainer phishing page posing as WalletLink, a wallet-connection brand, on a fr…

multi-xchange.firebaseapp.com
Firebase subdomain; Telegram bot token in page script
Crypto wallet phishing, drainers and address-poisoning cluster (12 Nov 2026)

Reported Nov 12, 20261 report

PhishingReviewed

Fake Meta 'Page Appeal' site on chronos-reprieve-658a.s2506015.workers.dev steals Facebook logins and 2FA codes

Website scanning service ScanMalware posted on X on 12 November 2026 that chronos-reprieve-658a.s2506015[.]workers[.]dev is a confirmed scam. Its scan report describes a phishing kit imitating Meta's Privacy Center an…

chronos-reprieve-658a.s2506015.workers.dev
Path /analysis_center/; Cloudflare workers.dev subdomain; exfiltration via Telegram bot
Phishing kit exfiltrating to a Telegram bot (12 Nov 2026)

Reported Nov 12, 20261 report

Toll & delivery text (smishing)Reviewed

Fake ELTA Hellenic Post parcel page eltapackage.firebaseapp.com sends data to a Telegram bot

Website scanner ScanMalware posted on X on 11 November 2026 a "confirmed scam" verdict for eltapackage[.]firebaseapp[.]com. Its linked report says the page, titled "ΕΛΤΑ - Αποστολή πακέτων" (ELTA - parcel shipping), i…

eltapackage.firebaseapp.com
Hosted on shared firebaseapp.com domain; page title 'ΕΛΤΑ - Αποστολή πακέτων'
Phishing kit exfiltrating to a Telegram bot (12 Nov 2026)

Reported Nov 11, 20261 report

Results reflect reports submitted to Scammers.com. Entries marked “Unverified” have not yet been reviewed. A listing is not a finding that any person or business committed fraud.