# PhishDestroy domain threat record: xfntiy.weebly.com

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/xfntiy.weebly.com/
Machine-readable companion: https://phishdestroy.io/domain/xfntiy.weebly.com/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: observed active
- First observed by PhishDestroy: 2026-09-11 09:57:14 UTC
- Last availability or vendor check: 2026-10-22 10:07:28 UTC
- Stored record updated: 2026-10-22 15:45:01 UTC
- VirusTotal detections in the stored snapshot: 18/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: xfinity

## Stored infrastructure

- Observed IP address: 74.115.51.8
- Registrar in stored WHOIS data: Weebly
- Last stored HTTP status: 404
- Registration date (registry RDAP, weebly.com): 2006-03-29 00:25:07 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a08dfd-2fb3-70eb-88f2-d7c45bde392d/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/xfntiy.weebly.com
- Certificate Transparency search: https://crt.sh/?q=%25.xfntiy.weebly.com
- Web Archive lookup: https://web.archive.org/web/*/https://xfntiy.weebly.com/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
xfntiy.weebly.com is a phishing page that impersonates Xfinity. It is hosted as a free Weebly site under a misspelled version of the brand name, with the letters of "xfinity" shuffled to "xfntiy" so it passes a quick glance. PhishDestroy first flagged it on 2026-09-11. On 2026-10-19 the address still resolved, but the root page served no content.

How the scam works
Xfinity impersonation pages usually reach victims through emails or texts about billing problems, account suspensions or service updates. The link leads to a page styled like Xfinity's sign-in or payment screen. Anything typed there, such as the Xfinity username and password, the linked email account, or card details, goes to the operator rather than to Xfinity. The page carried only the generic title "Home," which does not name the brand, but scanners matched its content to Xfinity.

Evidence
On 2026-09-23, 18 of 89 VirusTotal engines flagged the site. They included BitDefender, ESET, Fortinet, Forcepoint ThreatSeeker, Emsisoft, G-Data, Ermes and alphaMountain.ai, a mix of vendors that reached the same conclusion independently. urlscan.io returned a malicious verdict and recognized Xfinity as the brand being imitated. That brand match supports our impersonation classification. PhishDestroy lists the site on its blocklist.

Infrastructure
The site sits on Weebly's website builder, served from 74.115.51.8 on Weebly, Inc.'s US network. The 2006-03-29 registration date belongs to the parent weebly.com domain, so it says nothing about when this subdomain was created. A free builder subdomain costs the operator nothing and inherits the platform's reputation. The Let's Encrypt certificate is Weebly's standard platform certificate, so the padlock in the browser is not a sign that the page is legitimate.

What to do
If you entered your Xfinity credentials, change the password right away from Xfinity's official app or by typing the address yourself. Turn on two-step verification and check the account for changed contact details or unfamiliar devices. If the same password protects your email or other accounts, change it there too. If you submitted card details, call your bank to block the card and dispute any charges. Defenders should block the hostname, watch Weebly-hosted links in inbound mail for brand misspellings, and report the page to Weebly for removal.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a08dfd-2fb3-70eb-88f2-d7c45bde392d/
VirusTotal report: https://www.virustotal.com/gui/domain/xfntiy.weebly.com
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=xfntiy.weebly.com
Archived copy: https://web.archive.org/web/20260922012305/https://xfntiy.weebly.com/
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 09:44:23 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a08dfd-2fb3-70eb-88f2-d7c45bde392d.png
  Captured: 2026-09-12 08:12:08 UTC
- URLScan capture: https://screenshots.phishdestroy.io/01a08dfd-2fb3-70eb-88f2-d7c45bde392d.png
  Captured: 2026-09-12 08:12:08 UTC
  Source report: https://urlscan.io/result/01a08dfd-2fb3-70eb-88f2-d7c45bde392d/
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/68157e3a-7007-4bdd-b716-93e06f2edaf0.png
  Captured: 2026-09-11 10:01:19 UTC
  Source report: https://radar.cloudflare.com/scan/68157e3a-7007-4bdd-b716-93e06f2edaf0
  SHA-256: e56ad73c951d5da040e4ebd7dabe821e52e99c7905a19befd7e3e9e42b6ad329
- URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a08dfc-4d84-75dd-8cbf-9f0c3a830341.png
  Captured: 2026-09-11 01:02:08 UTC
  Source report: https://urlscan.io/result/01a08dfc-4d84-75dd-8cbf-9f0c3a830341/
  SHA-256: 7fd1c3556654d6b91518e1d3014bb2a86dba623089e2c0a6ba0facbc89b4cc7c
- URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a08fed-7d02-74e9-b2ab-a2cb460df13e.png
  Captured: 2026-09-11 10:05:08 UTC
  Source report: https://urlscan.io/result/01a08fed-7d02-74e9-b2ab-a2cb460df13e/
  SHA-256: a0fe98ccf6f267a470e8c79ab93903889bd83dc233536de2eb86da7253d89609
- URLScan · 2026-09-11: https://screenshots.phishdestroy.io/us/01a0902b-4182-772d-8e15-502172a74980.png
  Captured: 2026-09-11 11:12:40 UTC
  Source report: https://urlscan.io/result/01a0902b-4182-772d-8e15-502172a74980/
  SHA-256: 8f3b2f9a6990cf4cb55b81790d0b5c45659e61e569715f046fbc3ca0cf0949d5
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0ad42-be0d-77dd-8a0f-ae57cc03c789.png
  Captured: 2026-09-17 02:47:16 UTC
  Source report: https://urlscan.io/result/01a0ad42-be0d-77dd-8a0f-ae57cc03c789/
  SHA-256: 8f3b2f9a6990cf4cb55b81790d0b5c45659e61e569715f046fbc3ca0cf0949d5
- URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0ad51-0d32-7354-aada-e286e4ba7b5a.png
  Captured: 2026-09-17 03:02:55 UTC
  Source report: https://urlscan.io/result/01a0ad51-0d32-7354-aada-e286e4ba7b5a/
  SHA-256: 8f3b2f9a6990cf4cb55b81790d0b5c45659e61e569715f046fbc3ca0cf0949d5
- URLScan · 2026-09-20: https://screenshots.phishdestroy.io/us/01a0bf40-5668-775b-ad5b-fb7c75b2c6c9.png
  Captured: 2026-09-20 14:37:46 UTC
  Source report: https://urlscan.io/result/01a0bf40-5668-775b-ad5b-fb7c75b2c6c9/
  SHA-256: 8f3b2f9a6990cf4cb55b81790d0b5c45659e61e569715f046fbc3ca0cf0949d5

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T00:19:12Z",
        "uuid": "01a08dfd-2fb3-70eb-88f2-d7c45bde392d",
        "scanned_at": "2026-09-11T01:03:02Z",
        "final_url": "https://xfntiy.weebly.com/",
        "status": 200,
        "redirected": "sub-domain",
        "redirects": [
            {
                "to": "https://www.xfntiy.weebly.com/",
                "from": "http://www.xfntiy.weebly.com/",
                "status": 307
            },
            {
                "to": "http://www.xfntiy.weebly.com/",
                "from": "https://www.xfntiy.weebly.com/",
                "status": 307
            },
            {
                "to": "http://xfntiy.weebly.com/",
                "from": "http://www.xfntiy.weebly.com/",
                "status": 301
            },
            {
                "to": "https://xfntiy.weebly.com/",
                "from": "http://xfntiy.weebly.com/",
                "status": 307
            }
        ],
        "ip": "74.115.51.9",
        "ptr": "wildcard.weebly.com",
        "domains": [
            "cdn2.editmysite.com",
            "cdn11.editmysite.com",
            "ec.editmysite.com",
            "www.gstatic.com",
            "www.google.com",
            "cdn3.editmysite.com",
            "ssl.google-analytics.com",
            "fonts.googleapis.com",
            "www.xfntiy.weebly.com"
        ],
        "ips": [
            "142.251.20.94",
            "34.218.174.111",
            "142.251.156.119",
            "192.178.183.97",
            "151.101.1.46",
            "151.101.193.46",
            "192.178.183.95",
            "74.115.51.9"
        ],
        "asns": [
            "15169",
            "16509",
            "54113",
            "27647"
        ],
        "countries": [
            "US"
        ],
        "doc_hash": "53a9dfadda35e11f075d474cc531cf6ba3f06cd2a332c5cd7efdcd99dd2079dc",
        "script_hashes": [
            "397452d9f6a2ea6a2135b45c9e40139c68ac6661f3bab4413e7299586ccb408a",
            "5a630b41e7c3d34392bcb150a5731b6261bc6314d71d5db8407a646af15bf8af",
            "b6353ca52760aba4e7547ae9861db68158dc2af0f4febece55e5c775ee4449f5",
            "f75570c56743e8c705cb06f5f1f9b1f8f2cc13119f5e2acda2f3bb8d987de94a",
            "446f48f512ecc0b771af3c21a3036de3a1c5740d1e6bdbb61448834326d0c738",
            "c4cd233d3d6b0f184e99d5017e521b4c6f9106d3e546864a8ba516189b934311",
            "cfbf67a85c039719090cff2c4718de99203b1ced78cfb8fae5f7240d2f1570b7"
        ],
        "globals": [
            "Weebly",
            "STATIC_BASE",
            "ASSETS_BASE",
            "STYLE_PREFIX",
            "$",
            "jQuery",
            "_W",
            "publishedWBJP",
            "RECAPTCHA_PUBLIC_KEY",
            "INVISIBLE_RECAPTCHA_PUBLIC_KEY",
            "_",
            "Mustache",
            "jQBrowser",
            "PlatformElement",
            "whenThemeCSSLoaded",
            "isThemeCSSLoaded",
            "blogCommentDisplayForm",
            "YTPlayer",
            "VimeoPlayer",
            "Sd",
            "Rd",
            "Cd",
            "videojs",
            "_V_",
            "jsonrpc",
            "getCartCount",
            "getCartNavElement",
            "reportCartNavElement",
            "initPublishedFlyoutMenus",
            "flyoutMenusRefreshable",
            "initEditorFlyoutMenus",
            "refreshNavCondense",
            "disableFlyouts",
            "FlyoutMenu",
            "objectify",
            "mejs",
            "MediaElement",
            "MediaElementPlayer",
            "require",
            "platformElementRequire"
        ],
        "cookies": [
            "__cf_bm",
            "_snow_ses.99cc",
            "_snow_id.99cc",
            "sp"
        ],
        "storage_keys": [
            "modernizr",
            "snowplowOutQueue_snowday__wn_post2"
        ],
        "tls": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "weebly.com",
            "protocol": "TLS 1.3",
            "valid_to": "2026-11-06T20:20:53Z",
            "valid_from": "2026-08-08T20:20:54Z"
        },
        "domain_age_days": 0,
        "apex_age_days": 4916,
        "tls_age_days": 33,
        "tls_valid_days": 89,
        "requests": 39,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "xfinity"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            },
            "urlscan": {
                "tags": [
                    "phishing"
                ],
                "score": 100,
                "brands": [
                    "Xfinity"
                ],
                "malicious": true,
                "categories": [
                    "phishing"
                ]
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html; charset=UTF-8"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:32:00Z",
        "uuid": "68157e3a-7007-4bdd-b716-93e06f2edaf0",
        "scanned_at": "2026-09-11T10:01:19Z",
        "final_url": "https://xfntiy.weebly.com/",
        "status": 200,
        "history": [
            {
                "url": "https://xfntiy.weebly.com/",
                "status": 200
            }
        ],
        "dom_hash": "ee70d21003fdd54e26a95feaef09aa24a99310c10ba9733103a73a5ee010b7b1",
        "doc_hash": "05402db8919414d47de0ddf413d8c7ce4215a72d98861b299c843e1e730e438e",
        "url_risks": [
            "Phishing"
        ],
        "domain_risks": [
            "Phishing",
            "Security threats",
            "CIPA Filter",
            "CIPA"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "xfntiy.weebly.com",
                "type": "A",
                "value": "74.115.51.9"
            },
            {
                "name": "xfntiy.weebly.com",
                "type": "A",
                "value": "74.115.51.8"
            }
        ],
        "dnssec_valid": false,
        "ip": "74.115.51.9",
        "verdict": {
            "tags": [
                "phishing"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "MarkMonitor Inc.",
            "created": "2006-03-29T00:25:07Z",
            "updated": "2026-08-10T19:04:53Z",
            "expires": "2032-03-28T23:25:07Z",
            "nameservers": [
                "ns-123.awsdns-15.com",
                "ns-1500.awsdns-59.org",
                "ns-1797.awsdns-32.co.uk",
                "ns-646.awsdns-16.net"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T16:21:55Z",
        "analysis_at": "2026-10-16T18:25:00Z",
        "stats": {
            "timeout": 0,
            "harmless": 45,
            "malicious": 19,
            "suspicious": 0,
            "undetected": 28
        },
        "detections": {
            "ESET": "phishing",
            "Ermes": "phishing",
            "VIPRE": "malware",
            "G-Data": "phishing",
            "Lionic": "phishing",
            "Sophos": "phishing",
            "Webroot": "malicious",
            "ZeroFox": "malicious",
            "Emsisoft": "phishing",
            "Fortinet": "phishing",
            "Netcraft": "malicious",
            "URLQuery": "malicious",
            "Kaspersky": "phishing",
            "LevelBlue": "phishing",
            "Gridinsoft": "phishing",
            "MalwareURL": "phishing",
            "BitDefender": "phishing",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "created": "2006-03-29T00:00:00Z",
        "updated": "2026-03-30T00:00:00Z",
        "first_seen": "2026-09-10T17:25:55Z",
        "dns": [
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.8"
            },
            {
                "ttl": 3600,
                "type": "A",
                "value": "74.115.51.9"
            }
        ],
        "dns_at": "2026-10-16T18:30:13Z",
        "jarm": "27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6",
        "cert": {
            "san": [
                "*.weebly.com",
                "weebly.com"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "537be20737256ed93d00e736e0c91ccf99d",
            "sha256": "0ab63db1f470cfa51bc6372a78a47a8db5f315e8e14c970970e78d8f6ccd9281",
            "subject": "weebly.com",
            "valid_to": "2027-01-04T19:46:47Z",
            "valid_from": "2026-10-06T19:46:48Z"
        },
        "whois": []
    }
}
```