xfi-voice[.]weebly[.]com

The domain xfi-voice.weebly.com is currently listed as an active high‑risk generic phishing site. Infrastructure analysis shows the domain resolves to the IPv4 address 74.115.51.8. The hosting provider associated with this address has not been disclosed, but the IP is reachable and serves content that has triggered multiple security controls. VirusTotal reports that 11 of 91 scanned security vendors flag the domain as malicious, indicating a moderate consensus among automated analysis tools. Google Safe Browsing classifies the site under the social engineering category, confirming that the URL is recognized as a phishing vector. The domain is also present on a single external security blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its malicious reputation.

Registration data indicates the domain was created through Square, Inc., a registrar that does not provide additional protective metadata. No authoritative nameserver records were returned (NS_NOT_FOUND), limiting visibility into the DNS configuration and complicating sinkhole or takedown efforts. The absence of publicly available page title or brand targeting information prevents a precise description of the lure employed, leaving the exact phishing content uncertain.

Given the confirmed detections, defenders should prioritize immediate blocking of xfi-voice.weebly.com at network perimeter devices, DNS resolvers, and endpoint protection suites. Continuous monitoring of the associated IP address (74.115.51.8) is advised, as threat actors may reuse the host for additional campaigns. Organizations using Google Safe Browsing or PhishDestroy can rely on existing blocklists, but supplemental manual rule creation is recommended to cover environments that do not ingest these feeds. Incident response teams should treat any credential submissions or redirects to this domain as compromised and enforce credential reset procedures.