chartreuse-color-879469[.]framer[.]app

This domain, chartreuse-color-879469.framer.app, is identified as a credential theft operation targeting users of a major telecommunications provider. The page mimics the legitimate sign-in portal of Xfinity, a widely recognized brand, to deceive victims into submitting their account credentials. Analysis indicates the threat actor designed the interface to closely resemble the authentic login page, increasing the likelihood of successful compromise. Such attacks typically lead to unauthorized account access, financial fraud, or further exploitation through social engineering. Infrastructure analysis reveals the domain was registered through Framer and currently resolves to the IP address 31.43.160.6, hosted within AS16509 (Amazon.com, Inc.) in the Netherlands. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites. Detection metrics show the domain is flagged by 22 out of 95 security vendors on VirusTotal, while appearing on one additional security blocklist. The domain's page title explicitly reads 'Xfinity Sign In,' further confirming its impersonation intent. No historical registration data is available, suggesting a recent deployment aligned with the campaign's objectives. Users who visited chartreuse-color-879469.framer.app should immediately assume their credentials may have been compromised. Affected individuals must change their Xfinity account password using a trusted device and enable multi-factor authentication if not already active. Monitoring for unauthorized transactions or account activity is critical, as stolen credentials are often exploited within hours. If financial information was entered, contacting the associated institution to report potential fraud is advised. Additionally, scanning the device used to access the domain for malware or unauthorized modifications is recommended to mitigate secondary threats.