guileless-mooncake-6f836c[.]netlify[.]app

This domain, guileless-mooncake-6f836c.netlify.app, is identified as a high-risk credential theft operation impersonating Xfinity, a telecommunications provider. Analysis indicates the threat actor designed the site to harvest user login credentials by mimicking the legitimate Xfinity sign-in portal, as evidenced by the page title "Sign in to Xfinity." No cryptocurrency drainer kit or payment redirection was observed, confirming the attack vector as pure credential theft targeting customer accounts for potential account takeover or identity fraud. Infrastructure analysis reveals the domain was registered through Netlify on March 12, 2026, and currently resolves to IP address 98.84.224.111, hosted on AS14618 (Amazon.com, Inc.) in the United States. The SSL certificate is issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1, a legitimate but frequently abused certificate authority in phishing campaigns. VirusTotal detection shows 21 out of 95 security vendors flagging the domain as malicious, while Google Safe Browsing explicitly classifies it as phishing. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. As of the latest verification, the domain remains active and continues to host the fraudulent Xfinity login page. No takedown or sinkholing has been observed, maintaining the high-risk status for unsuspecting users. Organizations and individuals are advised to block the domain at the DNS or network level and implement multi-factor authentication for Xfinity accounts to mitigate credential theft risks. Endpoint protection systems should be updated to include this domain in denylists, and users should be educated to verify URLs before entering credentials, particularly for telecommunications or financial services.