# PhishDestroy domain threat record: upgradexfinty.weebly.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/upgradexfinty.weebly.com/
Machine-readable companion: https://phishdestroy.io/domain/upgradexfinty.weebly.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-05 15:13:19 UTC
- Last availability or vendor check: 2026-10-23 01:26:52 UTC
- Stored record updated: 2026-10-23 18:22:59 UTC
- VirusTotal detections in the stored snapshot: 18/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: flagged

## Stored classification

- Targeted brand: xfinity

## Stored infrastructure

- Observed IP address: 74.115.51.8
- Registrar in stored WHOIS data: Square, Inc.
- Registrar country in stored WHOIS data: US
- Last stored HTTP status: 404
- Registration date (registry RDAP, weebly.com): 2006-03-29 00:25:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a07220-3070-702e-b847-63e56082b5b3/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/upgradexfinty.weebly.com
- Certificate Transparency search: https://crt.sh/?q=%25.upgradexfinty.weebly.com
- Web Archive lookup: https://web.archive.org/web/*/https://upgradexfinty.weebly.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
upgradexfinty.weebly.com was a credential phishing page built on a free Weebly site and dressed up as the Xfinity sign-in portal. The subdomain itself is the lure: "upgrade" suggests a service or account update, and "xfinty" drops a letter from the real brand name, a misspelling that is easy to miss in an email link. PhishDestroy first saw it on 2026-09-05. The site has been offline since 2026-09-23 and still served no content when last checked on 2026-10-19.

How the scam works
The page carried the title "Xfinity Sign in - Xfinity Sign in" so the browser tab looked like the genuine login screen. Pages of this kind are usually reached through emails or texts claiming an account upgrade, a billing problem or a mailbox limit. They ask the visitor for an Xfinity email address and password, and sometimes for security answers or payment details. Whatever is typed goes to the operator, who can then read the victim's Xfinity mailbox, reset passwords on other services tied to that address, and send further phishing from a trusted account.

Evidence
18 of 89 VirusTotal engines flagged the site as of 2026-09-16, including alphaMountain.ai, BitDefender, Chong Lua Dao, ESET, Emsisoft, Ermes, Fortinet and G-Data. Google Safe Browsing listed it under SOCIAL_ENGINEERING, so Chrome, Firefox and Safari would have shown visitors a warning. urlscan.io gave a malicious verdict and identified Xfinity as the imitated brand. PhishDestroy carries it on its blocklist.

Infrastructure
The 2006-03-29 registration date and the registrar, Square, Inc., belong to the parent weebly.com domain, not to this operator. The phishing page was a throwaway subdomain on Weebly's site builder, hosted on Weebly, Inc. infrastructure in the US. Using a free site builder lets an attacker borrow a well-established domain and its automatic HTTPS, which is why the padlock in the address bar said nothing about whether the page was safe.

What to do
If you entered your Xfinity credentials on this page, change your Xfinity password right away from the official app or by typing the address yourself, then turn on two-step verification. Check your mailbox for forwarding rules, recovery addresses or phone numbers you did not add. Change the password on any other account that used the same one, and reset passwords for services that send recovery links to your Xfinity email. Defenders should block weebly.com subdomains that impersonate Xfinity, search mail logs for messages linking to this host around 2026-09-05, and reset credentials for any users who clicked through.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a07220-3070-702e-b847-63e56082b5b3/
VirusTotal report: https://www.virustotal.com/gui/domain/upgradexfinty.weebly.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=upgradexfinty.weebly.com
Archived copy: https://web.archive.org/web/20260917140625/https://upgradexfinty.weebly.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:22:29 UTC

## Stored page captures

- Primary capture: https://i.ibb.co/xtzKVTH0/801914b8b72b.png
  Captured: 2026-09-05 15:13:19 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a07220-3070-702e-b847-63e56082b5b3.png
  Captured: 2026-09-05 15:13:19 UTC
  Source report: https://urlscan.io/result/01a07220-3070-702e-b847-63e56082b5b3/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e5b2781d-d541-4efe-9ab7-eaed960a4e0e.png
  Captured: 2026-09-05 16:01:39 UTC
  Source report: https://radar.cloudflare.com/scan/e5b2781d-d541-4efe-9ab7-eaed960a4e0e
  SHA-256: 7956240a1390c371d87a25b21e6cb440306094e1ecf0ae1f0dc1221cb7f2bc97
- URLScan · 2026-09-05: https://screenshots.phishdestroy.io/us/01a071a9-21a8-77f4-95d6-1fba8a9ce6e3.png
  Captured: 2026-09-05 13:01:53 UTC
  Source report: https://urlscan.io/result/01a071a9-21a8-77f4-95d6-1fba8a9ce6e3/
  SHA-256: 20d8f150e0a48b8103dceea2bde1f7303b81dccc2e42012f017ee5286e36fc11
- URLScan · 2026-09-07: https://screenshots.phishdestroy.io/us/01a07bf4-f08c-758c-bccb-cf622eff1470.png
  Captured: 2026-09-07 13:00:54 UTC
  Source report: https://urlscan.io/result/01a07bf4-f08c-758c-bccb-cf622eff1470/
  SHA-256: 074c88d745d59aa45277f8ed3a6383e3630a5103c70eb7e67ee436ce144d4347
- URLScan · 2026-09-09: https://screenshots.phishdestroy.io/us/01a086ca-6fff-7265-938b-1dd5e73db42c.png
  Captured: 2026-09-09 15:30:34 UTC
  Source report: https://urlscan.io/result/01a086ca-6fff-7265-938b-1dd5e73db42c/
  SHA-256: 065ed505e88651a969f039c1e5511bad133088f68be6560844f88bc0e268c1b5
- URLScan · 2026-09-15: https://screenshots.phishdestroy.io/us/01a0a487-a3a4-766b-bdf9-200041b71026.png
  Captured: 2026-09-15 10:05:55 UTC
  Source report: https://urlscan.io/result/01a0a487-a3a4-766b-bdf9-200041b71026/
  SHA-256: 065ed505e88651a969f039c1e5511bad133088f68be6560844f88bc0e268c1b5
- URLScan · 2026-10-02: https://screenshots.phishdestroy.io/us/01a0fd8a-afb9-7155-a091-fa89f5b4cfe9.png
  Captured: 2026-10-02 16:55:32 UTC
  Source report: https://urlscan.io/result/01a0fd8a-afb9-7155-a091-fa89f5b4cfe9/
  SHA-256: 8709c2486a3077bc21f0a1be9ab5f518de2f2dab7ce28a35097475692345c3c1

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T04:24:11Z",
        "uuid": "01a07220-3070-702e-b847-63e56082b5b3",
        "scanned_at": "2026-09-05T15:11:53Z",
        "final_url": "https://upgradexfinty.weebly.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://upgradexfinty.weebly.com/",
                "from": "http://upgradexfinty.weebly.com/",
                "status": 307
            }
        ],
        "ip": "74.115.51.8",
        "ptr": "wildcard.weebly.com",
        "domains": [
            "cdn2.editmysite.com",
            "fonts.googleapis.com",
            "cdn11.editmysite.com",
            "fonts.gstatic.com",
            "ec.editmysite.com",
            "www.gstatic.com",
            "www.google.com",
            "cdn3.editmysite.com",
            "ssl.google-analytics.com",
            "ajax.googleapis.com"
        ],
        "ips": [
            "2a00:1450:4001:c25::5e",
            "34.218.174.111",
            "151.101.129.46",
            "142.251.157.119",
            "151.101.1.46",
            "2a00:1450:4001:c0f::61",
            "142.251.14.94",
            "2a00:1450:4001:c25::5f",
            "2a00:1450:4001:c17::5f",
            "2a04:4e42::302",
            "74.115.51.8"
        ],
        "asns": [
            "15169",
            "16509",
            "54113",
            "27647"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "link_domains": [
            "www.weebly.com"
        ],
        "doc_hash": "e365e51ece7308edd90317b894de423db93c7645a66aeec2972403fddd694d8b",
        "script_hashes": [
            "8a295e631b0d74ebc6b734fdd9a2d5b29653da10a362599b0004ee135c115ce9",
            "a16df105a4c2f66f83e36051a5d4b3e7399fadc9046f779b7f373a5dc46b2361"
        ],
        "globals": [
            "STATIC_BASE",
            "ASSETS_BASE",
            "STYLE_PREFIX",
            "$",
            "jQuery",
            "Weebly",
            "_W",
            "publishedWBJP",
            "RECAPTCHA_PUBLIC_KEY",
            "INVISIBLE_RECAPTCHA_PUBLIC_KEY",
            "_",
            "Mustache",
            "jQBrowser",
            "PlatformElement",
            "whenThemeCSSLoaded",
            "isThemeCSSLoaded",
            "blogCommentDisplayForm",
            "YTPlayer",
            "VimeoPlayer",
            "Sd",
            "Rd",
            "Cd",
            "videojs",
            "_V_",
            "jsonrpc",
            "getCartCount",
            "getCartNavElement",
            "reportCartNavElement",
            "initPublishedFlyoutMenus",
            "flyoutMenusRefreshable",
            "initEditorFlyoutMenus",
            "refreshNavCondense",
            "disableFlyouts",
            "FlyoutMenu",
            "objectify",
            "mejs",
            "MediaElement",
            "MediaElementPlayer",
            "require",
            "platformElementRequire"
        ],
        "cookies": [
            "__cf_bm",
            "_snow_ses.e38b",
            "_snow_id.e38b",
            "sp"
        ],
        "storage_keys": [
            "modernizr",
            "snowplowOutQueue_snowday__wn_post2"
        ],
        "tls": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "weebly.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-06T20:20:53Z",
            "valid_from": "2026-08-08T20:20:54Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 4911,
        "tls_age_days": 27,
        "tls_valid_days": 89,
        "requests": 40,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "xfinity"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Xfinity"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T04:00:05Z",
        "uuid": "e5b2781d-d541-4efe-9ab7-eaed960a4e0e",
        "scanned_at": "2026-09-05T16:01:39Z",
        "final_url": "https://upgradexfinty.weebly.com/",
        "status": 200,
        "history": [
            {
                "url": "https://upgradexfinty.weebly.com/",
                "status": 200
            }
        ],
        "dom_hash": "359265b3b6d916b93f26f049040b8f149081c6e69f22812a2b4c196cdc6ff573",
        "doc_hash": "b18eca53ec5e93f1233493973779acfacb5d6bf04cc52d91a1c363c9e3816be4",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "upgradexfinty.weebly.com",
                "type": "A",
                "value": "74.115.51.8"
            },
            {
                "name": "upgradexfinty.weebly.com",
                "type": "A",
                "value": "74.115.51.9"
            }
        ],
        "dnssec_valid": false,
        "ip": "74.115.51.8",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2006-03-29T00:25:07Z",
            "updated": "2026-08-10T19:04:53Z",
            "expires": "2032-03-28T23:25:07Z",
            "nameservers": [
                "ns-123.awsdns-15.com",
                "ns-1500.awsdns-59.org",
                "ns-1797.awsdns-32.co.uk",
                "ns-646.awsdns-16.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-23T02:27:22Z",
        "analysis_at": "2026-10-21T05:40:08Z",
        "stats": {
            "timeout": 0,
            "harmless": 44,
            "malicious": 19,
            "suspicious": 0,
            "undetected": 29
        },
        "detections": {
            "ESET": "phishing",
            "Ermes": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "ZeroFox": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Kaspersky": "phishing",
            "Gridinsoft": "phishing",
            "SafeToOpen": "phishing",
            "BitDefender": "phishing",
            "Chong Lua Dao": "malicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2006-03-29T00:00:00Z",
        "updated": "2026-03-30T00:00:00Z",
        "first_seen": "2026-09-05T01:07:08Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.9"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.8"
            }
        ],
        "dns_at": "2026-10-21T05:45:23Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "537be20737256ed93d00e736e0c91ccf99d",
            "sha256": "0ab63db1f470cfa51bc6372a78a47a8db5f315e8e14c970970e78d8f6ccd9281",
            "subject": "weebly.com",
            "valid_to": "2027-01-04T19:46:47Z",
            "valid_from": "2026-10-06T19:46:48Z"
        },
        "whois": []
    }
}
```