# PhishDestroy domain threat record: xfinity-l6rj.onrender.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/xfinity-l6rj.onrender.com/ Machine-readable companion: https://phishdestroy.io/domain/xfinity-l6rj.onrender.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-03 15:54:30 UTC - Last availability or vendor check: 2026-10-22 10:11:09 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 16/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: xfinity ## Stored infrastructure - Observed IP address: 216.24.57.7 - Registrar in stored WHOIS data: Render Services Inc. - Last stored HTTP status: 301 - Registration date (registry RDAP, onrender.com): 2015-03-28 01:20:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a067f9-8454-70bd-88a4-f40fee9d0510/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/xfinity-l6rj.onrender.com - Certificate Transparency search: https://crt.sh/?q=%25.xfinity-l6rj.onrender.com - Web Archive lookup: https://web.archive.org/web/*/https://xfinity-l6rj.onrender.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview xfinity-l6rj.onrender.com is a phishing page that poses as Xfinity and targets the provider's internet, TV and email customers. It runs as an app on Render's free hosting platform rather than on a domain the operator registered. PhishDestroy first flagged it on 2026-09-03. When checked on 2026-10-19 the site was still online and its address redirected visitors elsewhere. How the scam works The page title, "Xfinity_Render", reads like a deployment label that pairs the target brand with the hosting service. Pages like this are usually reached through texts or emails about billing problems, service suspensions or account alerts. They show a copy of the Xfinity sign-in screen and send whatever the victim types to the operator. A stolen Xfinity login can expose the linked email inbox, billing details and saved payment methods, and it is often tried against other services where the same password was reused. Evidence On 2026-09-16, 16 of 89 VirusTotal engines flagged the address. They include BitDefender, ESET, Fortinet, Emsisoft, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai and Gridinsoft. Detection from that many unrelated vendors makes a false positive unlikely. urlscan.io independently rated the page malicious and identified Xfinity as the imitated brand, which matches our classification. PhishDestroy lists it on its blocklist. Infrastructure The 2015-03-28 registration date and the registrar, Render Services Inc., belong to the parent platform domain. They say nothing about when this page appeared. The operator simply deployed an app under a randomized subdomain, a cheap and fast setup that inherits the platform's reputation. Hosting resolves to Render's network in the US. The Google Trust Services certificate is issued automatically to platform apps, so the padlock in the browser proves nothing about who runs the page. What to do If you entered your Xfinity username and password here, change the password from the official Xfinity app or by typing the address yourself, and change it anywhere else you reused it. Turn on two-step verification and check the account for unfamiliar contact details, recovery options or forwarding rules on the linked email. If you gave card details, contact your bank and watch for unauthorized charges. Defenders should block the full hostname rather than the whole platform domain and search mail and SMS logs for links to it. Abuse reports to Render's trust and safety team are the fastest route to having the app removed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a067f9-8454-70bd-88a4-f40fee9d0510/ VirusTotal report: https://www.virustotal.com/gui/domain/xfinity-l6rj.onrender.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xfinity-l6rj.onrender.com Archived copy: https://web.archive.org/web/20260903155714/https://xfinity-l6rj.onrender.com/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:51:04 UTC ## Stored page captures - Primary capture: https://i.ibb.co/f6MZ4cQ/a197809500ce.png Captured: 2026-09-03 15:54:30 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a067f9-8454-70bd-88a4-f40fee9d0510.png Captured: 2026-09-03 15:54:30 UTC Source report: https://urlscan.io/result/01a067f9-8454-70bd-88a4-f40fee9d0510/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T03:53:10Z", "uuid": "01a067f9-8454-70bd-88a4-f40fee9d0510", "scanned_at": "2026-09-03T15:53:35Z", "final_url": "https://xfinity-l6rj.onrender.com/", "status": 200, "ip": "216.24.57.7", "ptr": "ip-216-24-57-7.ingress.render.com", "domains": [ "lottie.host", "res.cloudinary.com", "fonts.gstatic.com", "images.pexels.com", "unpkg.com", "cdnjs.cloudflare.com", "ajax.googleapis.com", "img.icons8.com", "fonts.googleapis.com" ], "ips": [ "2606:4700::6810:4e06", "192.178.183.94", "65.8.131.114", "2a00:1450:4001:c13::5f", "2a02:6ea0:c700::19", "104.18.66.220", "104.18.1.22", "104.17.24.14", "2a00:1450:4001:c0f::5f", "216.24.57.7" ], "asns": [ "13335", "15169", "16509", "60068", "397273" ], "countries": [ "US", "DE" ], "doc_hash": "ce03ceb7d1a9ad2418ecfa4257df56cce0ec795fd64eab6ca04163e0a91f7da4", "globals": [ "lottie-player", "reactiveElementVersions", "litHtmlVersions", "litElementVersions", "togglePassword", "$", "jQuery" ], "cookies": [ "ci_session_xfinity", "__cf_bm", "_cfuvid" ], "tls": { "san": [ "onrender.com", "*.onrender.com" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "onrender.com", "protocol": "TLS 1.3", "valid_to": "2026-10-22T21:54:17Z", "valid_from": "2026-07-24T20:54:20Z" }, "domain_age_days": 13, "apex_age_days": 13, "tls_age_days": 40, "tls_valid_days": 90, "requests": 43, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 100, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "xfinity" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Xfinity" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.0.30" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:33:51Z", "uuid": "4ce9b6bc-a205-41ca-9c55-904817f83766", "scanned_at": "2026-09-03T16:34:06Z", "final_url": "https://xfinity-l6rj.onrender.com/", "status": 200, "history": [ { "url": "https://xfinity-l6rj.onrender.com/", "status": 200 } ], "dom_hash": "e03acc1e1ef6ae67aacb15c43397d570822dfde2f64a89bde917be2b192ceee9", "doc_hash": "ce03ceb7d1a9ad2418ecfa4257df56cce0ec795fd64eab6ca04163e0a91f7da4", "phishing_v2": [ "phishing" ], "url_risks": [ "Phishing" ], "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "xfinity-l6rj.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" }, { "name": "xfinity-l6rj.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com" }, { "name": "gcp-us-west1-1.origin.onrender.com", "type": "CNAME", "value": "gcp-us-west1-1.origin.onrender.com.cdn.cloudflare.net" } ], "dnssec_valid": false, "ip": "216.24.57.7", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "Amazon Registrar, Inc.", "created": "2015-03-28T01:20:58Z", "updated": "2026-05-15T17:25:02Z", "expires": "2027-03-28T01:20:58Z", "nameservers": [ "ns-1324.awsdns-37.org", "ns-1829.awsdns-36.co.uk", "ns-245.awsdns-30.com", "ns-813.awsdns-37.net" ] } } } ```