# PhishDestroy domain threat record: informationupdatenow.weebly.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/informationupdatenow.weebly.com/ Machine-readable companion: https://phishdestroy.io/domain/informationupdatenow.weebly.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-05 14:56:38 UTC - Last availability or vendor check: 2026-10-21 01:17:47 UTC - Stored record updated: 2026-10-22 14:22:42 UTC - VirusTotal detections in the stored snapshot: 20/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: xfinity ## Stored infrastructure - Observed IP address: 74.115.51.8 - Registrar in stored WHOIS data: Square, Inc. - Registrar country in stored WHOIS data: US - Last stored HTTP status: 404 - Registration date (registry RDAP, weebly.com): 2006-03-29 00:25:07 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a07210-e23d-713f-bc90-7fae5ccb9fab/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/informationupdatenow.weebly.com - Certificate Transparency search: https://crt.sh/?q=%25.informationupdatenow.weebly.com - Web Archive lookup: https://web.archive.org/web/*/https://informationupdatenow.weebly.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview informationupdatenow.weebly.com was a credential phishing page posing as an Xfinity sign-in screen, aimed at Xfinity customers who could be lured into re-entering their account details. The subdomain name suggests an urgent "information update," a pretext typical of account-verification lures. PhishDestroy first flagged it on 2026-09-05. The site went offline on 2026-10-07 and was still dead with no content at the root when last checked on 2026-10-19. How the scam works The page carried the plain title "Login" and copied Xfinity branding, so a visitor arriving from a message about updating account information would see what looked like a routine sign-in form. Anything typed there went to the operator, not to Xfinity. A stolen Xfinity login can expose email, billing and personal details, and it is valuable for account takeover and further phishing, especially if the same password is reused elsewhere. Evidence 20 of 89 VirusTotal engines flagged the page as of 2026-09-15, including BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, Emsisoft, alphaMountain.ai, CyRadar and Ermes. That is substantial agreement among independent security vendors. urlscan.io returned a malicious verdict and independently recognized Xfinity as the imitated brand, which matches our classification. PhishDestroy lists the domain on its blocklist. Infrastructure The page was built on Weebly, a free website builder, and hosted on Weebly's network in the US. The 2006-03-29 registration date and the registrar, Square, Inc., belong to the weebly.com parent domain, not to the scammer. The operator only needed to create a free site under a convincing subdomain name. The Let's Encrypt certificate came automatically with the platform, so the browser padlock said nothing about whether the page was genuine. What to do If you entered your Xfinity credentials on this page, change your Xfinity password right away from the official app or site. Then change it on every other account that shares the same password, and turn on two-step verification. Review your Xfinity account for unfamiliar contact details, devices or billing changes. Watch for follow-up messages that cite your account details to seem legitimate. Defenders should block the subdomain, search mail logs for messages linking to it, and report similar Weebly-hosted Xfinity lures to the platform for removal. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a07210-e23d-713f-bc90-7fae5ccb9fab/ VirusTotal report: https://www.virustotal.com/gui/domain/informationupdatenow.weebly.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=informationupdatenow.weebly.com Archived copy: https://web.archive.org/web/20260917135616/https://informationupdatenow.weebly.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:22:32 UTC ## Stored page captures - Primary capture: https://i.ibb.co/35FxR01S/dc50db0e458f.png Captured: 2026-09-05 14:56:38 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a07210-e23d-713f-bc90-7fae5ccb9fab.png Captured: 2026-09-05 14:56:38 UTC Source report: https://urlscan.io/result/01a07210-e23d-713f-bc90-7fae5ccb9fab/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d8e1f412-a4f7-4227-a800-15b2bd11fdda.png Captured: 2026-09-05 15:40:36 UTC Source report: https://radar.cloudflare.com/scan/d8e1f412-a4f7-4227-a800-15b2bd11fdda SHA-256: 705a997069b9e3f9eff4fac95c61d5ecc9e9f750194dc2d8dbc7cece00e93d51 - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a071a9-2a37-738c-93ce-d1efeeb1878f.png Captured: 2026-09-05 13:01:53 UTC Source report: https://urlscan.io/result/01a071a9-2a37-738c-93ce-d1efeeb1878f/ SHA-256: cac35b4699846514d398d4a796222891525deddc749bc4239f1800db0200e43c - URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a07268-780e-73f4-938c-f020a6e6b97b.png Captured: 2026-09-05 16:30:56 UTC Source report: https://urlscan.io/result/01a07268-780e-73f4-938c-f020a6e6b97b/ SHA-256: cac35b4699846514d398d4a796222891525deddc749bc4239f1800db0200e43c - URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a087ae-b2bf-739a-a6e6-6cd9b1d78a84.png Captured: 2026-09-09 19:39:37 UTC Source report: https://urlscan.io/result/01a087ae-b2bf-739a-a6e6-6cd9b1d78a84/ SHA-256: ee884052890ff51b77fc23dac3895d3c90223c31a7b5bcf3c555bfda1c9a6819 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:49:31Z", "uuid": "01a07210-e23d-713f-bc90-7fae5ccb9fab", "scanned_at": "2026-09-05T14:55:11Z", "final_url": "https://informationupdatenow.weebly.com/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://informationupdatenow.weebly.com/", "from": "http://informationupdatenow.weebly.com/", "status": 307 } ], "ip": "74.115.51.8", "ptr": "wildcard.weebly.com", "domains": [ "cdn2.editmysite.com", "cdn11.editmysite.com", "ec.editmysite.com", "www.gstatic.com", "www.google.com", "cdn3.editmysite.com", "ssl.google-analytics.com", "fonts.googleapis.com" ], "ips": [ "142.250.195.99", "34.218.174.111", "142.251.153.119", "142.250.195.232", "151.101.65.46", "151.101.193.46", "142.250.195.170", "74.115.51.8" ], "asns": [ "15169", "16509", "54113", "27647" ], "countries": [ "US" ], "doc_hash": "87a3bc400fcc989d0cc7ba72b89b73547db63ca9eb21179ce0506c4137971874", "script_hashes": [ "397452d9f6a2ea6a2135b45c9e40139c68ac6661f3bab4413e7299586ccb408a", "5a630b41e7c3d34392bcb150a5731b6261bc6314d71d5db8407a646af15bf8af", "b6353ca52760aba4e7547ae9861db68158dc2af0f4febece55e5c775ee4449f5", "f75570c56743e8c705cb06f5f1f9b1f8f2cc13119f5e2acda2f3bb8d987de94a", "446f48f512ecc0b771af3c21a3036de3a1c5740d1e6bdbb61448834326d0c738", "c4cd233d3d6b0f184e99d5017e521b4c6f9106d3e546864a8ba516189b934311", "cfbf67a85c039719090cff2c4718de99203b1ced78cfb8fae5f7240d2f1570b7" ], "globals": [ "Weebly", "STATIC_BASE", "ASSETS_BASE", "STYLE_PREFIX", "$", "jQuery", "_W", "publishedWBJP", "RECAPTCHA_PUBLIC_KEY", "INVISIBLE_RECAPTCHA_PUBLIC_KEY", "_", "Mustache", "jQBrowser", "PlatformElement", "whenThemeCSSLoaded", "isThemeCSSLoaded", "blogCommentDisplayForm", "YTPlayer", "VimeoPlayer", "Sd", "Rd", "Cd", "videojs", "_V_", "jsonrpc", "getCartCount", "getCartNavElement", "reportCartNavElement", "initPublishedFlyoutMenus", "flyoutMenusRefreshable", "initEditorFlyoutMenus", "refreshNavCondense", "disableFlyouts", "FlyoutMenu", "objectify", "mejs", "MediaElement", "MediaElementPlayer", "require", "platformElementRequire" ], "cookies": [ "__cf_bm", "_snow_ses.7814", "_snow_id.7814", "sp" ], "storage_keys": [ "modernizr", "snowplowOutQueue_snowday__wn_post2" ], "tls": { "san": [ "*.weebly.com", "weebly.com" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "weebly.com", "protocol": "TLS 1.3", "valid_to": "2026-11-06T20:20:53Z", "valid_from": "2026-08-08T20:20:54Z" }, "domain_age_days": 0, "apex_age_days": 4911, "tls_age_days": 27, "tls_valid_days": 89, "requests": 40, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "xfinity" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Xfinity" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:00:15Z", "uuid": "d8e1f412-a4f7-4227-a800-15b2bd11fdda", "scanned_at": "2026-09-05T15:40:36Z", "final_url": "https://informationupdatenow.weebly.com/", "status": 200, "history": [ { "url": "https://informationupdatenow.weebly.com/", "status": 200 } ], "dom_hash": "2cb464fdb7dc41392c66a367bbee120c7f1c4342ba184d28f8db79838d273a3c", "doc_hash": "87a3bc400fcc989d0cc7ba72b89b73547db63ca9eb21179ce0506c4137971874", "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "informationupdatenow.weebly.com", "type": "A", "value": "74.115.51.9" }, { "name": "informationupdatenow.weebly.com", "type": "A", "value": "74.115.51.8" } ], "dnssec_valid": false, "ip": "74.115.51.9", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2006-03-29T00:25:07Z", "updated": "2026-08-10T19:04:53Z", "expires": "2032-03-28T23:25:07Z", "nameservers": [ "ns-123.awsdns-15.com", "ns-1500.awsdns-59.org", "ns-1797.awsdns-32.co.uk", "ns-646.awsdns-16.net" ] } } } ```