# PhishDestroy threat dossier — connect-xfinitys-com-appsuite.weebly.com ================================================================ Fetched: 2026-07-26 09:18:59 UTC Canonical: https://phishdestroy.io/domain/connect-xfinitys-com-appsuite.weebly.com/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 100/100 (PhishDestroy scoring — see methodology below) Scam classification: Credential Phishing Targeted brand: Sui ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 22/94 security vendors flagged this domain Flagging vendors: ADMINUSLabs, alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, Ermes, ESET, Emsisoft, Forcepoint ThreatSeeker, Fortinet, G-Data, Google Safebrowsing, Gridinsoft, Kaspersky, LevelBlue, Lionic, MalwareURL, Netcraft, Phishtank, Sophos, VIPRE, Webroot Public blocklists: listed on 1 independent blocklist Google Safe Browsing: FLAGGED ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 74.115.51.9 (US, Oakland) ASN: AS27647 Weebly, Inc. Hosting org: Weebly, Inc. Registrar: MarkMonitor, Inc. Nameservers: ns-123.awsdns-15.com, ns-1500.awsdns-59.org, ns-1797.awsdns-32.co.uk, ns-646.awsdns-16.net Registered: 2026-04-24 Page title: Sign in to xfinity HTTP response: 404 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Let's Encrypt / E8 Expires: 2026-07-11 Status: INVALID chain Fingerprint: 5030d04ba7102135fff71e4de7c4b13a750ef5e1e8efa91f7ba49893b21d9e74 Subject Alternative Names (related infrastructure — often same operator): - weebly.com ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-04-24 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-04-24 16:54:19 UTC (by PhishDestroy tracker) First reported: 2026-04-24 16:52:55 UTC (abuse notice filed) Last verified: 2026-07-26 08:20:47 UTC Neutralised: 2026-06-06 17:35:24 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019dbfc2-f02a-72f3-ba2a-7875f6767d4e/ Wayback Machine: https://web.archive.org/web/*/connect-xfinitys-com-appsuite.weebly.com crt.sh CT logs: https://crt.sh/?q=%25.connect-xfinitys-com-appsuite.weebly.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=connect-xfinitys-com-appsuite.weebly.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/connect-xfinitys-com-appsuite.weebly.com URLhaus: https://urlhaus.abuse.ch/host/connect-xfinitys-com-appsuite.weebly.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-04-24 16:56:58 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] Is connect-xfinitys-com-appsuite.weebly.com a Fake Xfinity Login PhishDestroy identifies connect-xfinitys-com-appsuite.weebly.com as an active generic phishing domain impersonating Xfinity to harvest credentials. The page title 'Sign in to xfinity' mimics the legitimate Xfinity login portal, tricking users into submitting sensitive account details. No crypto drainer kit was observed, but the domain’s structure suggests credential theft is the primary objective. This domain was flagged by 16 out of 95 VirusTotal security vendors, with Google Safe Browsing classifying it under SOCIAL_ENGINEERING. It resolves to IP 74.115.51.9, was registered through MarkMonitor, Inc., and was created on March 29, 2006. The domain holds a Let's Encrypt SSL certificate, potentially misleading users into trusting the page. With 16 detections and SOCIAL_ENGINEERING classification, the risk of encountering malicious content remains high. The domain remains active as of the latest assessment. Users should avoid interacting with this page and report it immediately. Blocklists and security tools should flag this domain using the indicators provided. While the immediate threat can be mitigated through blocking and removal efforts, the domain’s age and registrar suggest a persistent risk for similar campaigns. Remain vigilant and verify links before submitting credentials. ## EVIDENCE HASHES ---------------------------------------------------------------- TLS cert SHA-256: 5030d04ba7102135fff71e4de7c4b13a750ef5e1e8efa91f7ba49893b21d9e74 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/connect-xfinitys-com-appsuite.weebly.com/ JSON API: https://api.destroy.tools/v1/check?domain=connect-xfinitys-com-appsuite.weebly.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 196,455 domains (66,089 alive under monitoring, 128,816 confirmed takedowns/dead). Site: https://phishdestroy.io