# PhishDestroy domain threat record: xfinityconnectemail.weebly.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/xfinityconnectemail.weebly.com/
Machine-readable companion: https://phishdestroy.io/domain/xfinityconnectemail.weebly.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-14 14:06:58 UTC
- Last availability or vendor check: 2026-10-21 01:17:22 UTC
- Stored record updated: 2026-10-22 14:25:28 UTC
- VirusTotal detections in the stored snapshot: 19/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: xfinity

## Stored infrastructure

- Observed IP address: 74.115.51.8
- Registrar in stored WHOIS data: Weebly
- Last stored HTTP status: 404
- Registration date (registry RDAP, weebly.com): 2006-03-29 00:25:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0a002-ce1a-74ed-8dfd-128e542fc4b2/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/xfinityconnectemail.weebly.com
- Certificate Transparency search: https://crt.sh/?q=%25.xfinityconnectemail.weebly.com
- Web Archive lookup: https://web.archive.org/web/*/https://xfinityconnectemail.weebly.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
xfinityconnectemail.weebly.com is an impersonation phishing page that posed as Xfinity. Its subdomain name suggests a connection to Xfinity email, which points to Xfinity customers as the targets. PhishDestroy first flagged it on 2026-09-14. The site has been offline since 2026-10-01, and at the last check on 2026-10-19 the root returned no content.

How the scam works
Pages like this are built on free website builders and dressed in a familiar brand so a victim arriving from an email or text believes they are on a legitimate Xfinity sign-in or account page. The page's generic title, "Home", is the kind of default a site builder produces. The address itself does the persuading by placing "xfinity" and "connect email" before the builder's domain. Anything typed into the form goes to the operator. That usually means an email address and password, sometimes along with security answers or payment details. Stolen email logins are especially damaging because they let attackers reset passwords on every other account tied to that inbox.

Evidence
On 2026-09-22, VirusTotal showed 19 of 89 security engines flagging the site. They included BitDefender, ESET, Emsisoft, Fortinet, Forcepoint ThreatSeeker, alphaMountain.ai, AlphaSOC and Ermes. That spread of independent vendors makes this more than a single-source call. urlscan.io rated the page malicious and recognized Xfinity branding on it, which confirms what the page was imitating. The domain is listed on the PhishDestroy blocklist.

Infrastructure
The page sat on a Weebly subdomain, served from Weebly, Inc. infrastructure in the US. The 2006-03-29 registration date belongs to Weebly's own parent domain, not to this operation. The subdomain was a throwaway page created on a free platform, so its age tells you nothing about trustworthiness. Its Let's Encrypt certificate came with the hosting automatically. The padlock in the browser only meant the connection was encrypted, not that the site was genuine.

What to do
If you entered your Xfinity or email password on this page, change it immediately from the official Xfinity site or app. Change it anywhere else you reused it, and turn on two-step verification. Review your email settings for forwarding rules or recovery addresses you did not add, and sign out of all active sessions. If you entered payment details, contact your bank. Defenders should block the subdomain, report similar brand-bearing site-builder pages to the hosting platform, and search mail logs for messages linking to it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a0a002-ce1a-74ed-8dfd-128e542fc4b2/
VirusTotal report: https://www.virustotal.com/gui/domain/xfinityconnectemail.weebly.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xfinityconnectemail.weebly.com
Archived copy: https://web.archive.org/web/20260922032618/https://xfinityconnectemail.weebly.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:18:44 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a0a002-ce1a-74ed-8dfd-128e542fc4b2.png
  Captured: 2026-09-14 14:06:58 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a0a002-ce1a-74ed-8dfd-128e542fc4b2.png
  Captured: 2026-09-15 03:30:12 UTC
  Source report: https://urlscan.io/result/01a0a002-ce1a-74ed-8dfd-128e542fc4b2/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/8d563df0-f690-4152-90b0-e1743de4ee01.png
  Captured: 2026-09-14 14:09:26 UTC
  Source report: https://radar.cloudflare.com/scan/8d563df0-f690-4152-90b0-e1743de4ee01
  SHA-256: 93b609c176827dbba80396f0e3721bc46d8e1b45d6cdf6cc72bf5f40e166bfde
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a03f-bc26-7688-95ab-6cdadd2b1a60.png
  Captured: 2026-09-14 14:08:59 UTC
  Source report: https://urlscan.io/result/01a0a03f-bc26-7688-95ab-6cdadd2b1a60/
  SHA-256: 6ffeb7657146a35d35ec091974c76805e6f0437e79830cc69ee8e310f3e72561
- URLScan · 2026-09-14: https://screenshots.phishdestroy.io/us/01a0a120-33e2-74f2-886b-5df6b2766eb9.png
  Captured: 2026-09-14 18:14:04 UTC
  Source report: https://urlscan.io/result/01a0a120-33e2-74f2-886b-5df6b2766eb9/
  SHA-256: 6ffeb7657146a35d35ec091974c76805e6f0437e79830cc69ee8e310f3e72561
- URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aadf-b6d7-73fb-8405-9da103d9fa54.png
  Captured: 2026-09-16 15:39:52 UTC
  Source report: https://urlscan.io/result/01a0aadf-b6d7-73fb-8405-9da103d9fa54/
  SHA-256: 38b0586a7afed42702d8fac2ca0ef9a51eb9a54744c38f7014a738c2eba6b447
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0af4c-2a03-75de-871c-935b50c4793c.png
  Captured: 2026-09-17 12:16:47 UTC
  Source report: https://urlscan.io/result/01a0af4c-2a03-75de-871c-935b50c4793c/
  SHA-256: 6ffeb7657146a35d35ec091974c76805e6f0437e79830cc69ee8e310f3e72561
- URLScan · 2026-09-21: https://screenshots.phishdestroy.io/us/01a0c1ea-4ad8-748c-a416-ac8a7f6d3cdb.png
  Captured: 2026-09-21 03:02:42 UTC
  Source report: https://urlscan.io/result/01a0c1ea-4ad8-748c-a416-ac8a7f6d3cdb/
  SHA-256: 7f6c6619d4c7090c8255ad38aabcd6973e57456aeb01f213c903e38d0bde8018
- URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0ce78-f5e0-729d-b37b-0e418a3f7987.png
  Captured: 2026-09-23 13:34:06 UTC
  Source report: https://urlscan.io/result/01a0ce78-f5e0-729d-b37b-0e418a3f7987/
  SHA-256: f9592d55eb422721bf0274cac87c4392f8e448d1fb812c9b1e38846b27989970

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:15:10Z",
        "uuid": "01a0a002-ce1a-74ed-8dfd-128e542fc4b2",
        "scanned_at": "2026-09-14T13:02:21Z",
        "final_url": "https://xfinityconnectemail.weebly.com/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://xfinityconnectemail.weebly.com/",
                "from": "http://xfinityconnectemail.weebly.com/",
                "status": 307
            }
        ],
        "ip": "74.115.51.8",
        "ptr": "wildcard.weebly.com",
        "domains": [
            "cdn2.editmysite.com",
            "fonts.googleapis.com",
            "fonts.gstatic.com",
            "cdn11.editmysite.com",
            "ec.editmysite.com",
            "www.gstatic.com",
            "www.google.com",
            "cdn3.editmysite.com",
            "ssl.google-analytics.com",
            "ajax.googleapis.com"
        ],
        "ips": [
            "52.24.136.206",
            "142.251.110.94",
            "142.251.157.119",
            "142.251.127.97",
            "142.251.13.94",
            "192.178.183.95",
            "172.217.208.95",
            "151.101.193.46",
            "74.115.51.8"
        ],
        "asns": [
            "16509",
            "15169",
            "54113",
            "27647"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "c64e8a23a04053b8f01398616e25b37f488524af32f0ed37319640e320ecbdaa",
        "script_hashes": [
            "8a295e631b0d74ebc6b734fdd9a2d5b29653da10a362599b0004ee135c115ce9",
            "a16df105a4c2f66f83e36051a5d4b3e7399fadc9046f779b7f373a5dc46b2361"
        ],
        "globals": [
            "STATIC_BASE",
            "ASSETS_BASE",
            "STYLE_PREFIX",
            "$",
            "jQuery",
            "Weebly",
            "_W",
            "publishedWBJP",
            "RECAPTCHA_PUBLIC_KEY",
            "INVISIBLE_RECAPTCHA_PUBLIC_KEY",
            "_",
            "Mustache",
            "jQBrowser",
            "PlatformElement",
            "whenThemeCSSLoaded",
            "isThemeCSSLoaded",
            "blogCommentDisplayForm",
            "YTPlayer",
            "VimeoPlayer",
            "Sd",
            "Rd",
            "Cd",
            "videojs",
            "_V_",
            "jsonrpc",
            "getCartCount",
            "getCartNavElement",
            "reportCartNavElement",
            "initPublishedFlyoutMenus",
            "flyoutMenusRefreshable",
            "initEditorFlyoutMenus",
            "refreshNavCondense",
            "disableFlyouts",
            "FlyoutMenu",
            "objectify",
            "mejs",
            "MediaElement",
            "MediaElementPlayer",
            "require",
            "platformElementRequire"
        ],
        "cookies": [
            "__cf_bm",
            "_snow_ses.bc3a",
            "_snow_id.bc3a",
            "sp"
        ],
        "storage_keys": [
            "modernizr",
            "snowplowOutQueue_snowday__wn_post2"
        ],
        "tls": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "weebly.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-06T20:20:53Z",
            "valid_from": "2026-08-08T20:20:54Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 4920,
        "tls_age_days": 36,
        "tls_valid_days": 89,
        "requests": 35,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 97,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "xfinity"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Xfinity"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T00:26:11Z",
        "uuid": "8d563df0-f690-4152-90b0-e1743de4ee01",
        "scanned_at": "2026-09-14T14:09:26Z",
        "final_url": "https://xfinityconnectemail.weebly.com/",
        "status": 200,
        "history": [
            {
                "url": "https://xfinityconnectemail.weebly.com/",
                "status": 200
            }
        ],
        "dom_hash": "7ca7c510f2f5f2b4ed4a5f23d2345c6415703343ac14b1326a4f35da4703e6db",
        "doc_hash": "918c34dde4fe24a4103ff900b800d40b44a545b5337bea3d7722c843998907e4",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "xfinityconnectemail.weebly.com",
                "type": "A",
                "value": "74.115.51.9"
            },
            {
                "name": "xfinityconnectemail.weebly.com",
                "type": "A",
                "value": "74.115.51.8"
            }
        ],
        "dnssec_valid": false,
        "ip": "74.115.51.9",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2006-03-29T00:25:07Z",
            "updated": "2026-08-10T19:04:53Z",
            "expires": "2032-03-28T23:25:07Z",
            "nameservers": [
                "ns-123.awsdns-15.com",
                "ns-1500.awsdns-59.org",
                "ns-1797.awsdns-32.co.uk",
                "ns-646.awsdns-16.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T11:57:21Z",
        "analysis_at": "2026-10-14T15:41:41Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 15,
            "suspicious": 1,
            "undetected": 31
        },
        "detections": {
            "ESET": "phishing",
            "Ermes": "not recommended",
            "VIPRE": "phishing",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "CyRadar": "phishing",
            "Webroot": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing"
        },
        "reputation": 0,
        "created": "2006-03-29T00:00:00Z",
        "updated": "2026-03-30T00:00:00Z",
        "first_seen": "2026-09-14T08:11:11Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.9"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.8"
            }
        ],
        "dns_at": "2026-10-14T16:02:35Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "537be20737256ed93d00e736e0c91ccf99d",
            "sha256": "0ab63db1f470cfa51bc6372a78a47a8db5f315e8e14c970970e78d8f6ccd9281",
            "subject": "weebly.com",
            "valid_to": "2027-01-04T19:46:47Z",
            "valid_from": "2026-10-06T19:46:48Z"
        },
        "whois": []
    }
}
```