xfinityconnnects[.]netlify[.]app

The domain xfinityconnnects.netlify.app is currently active and hosts a generic phishing infrastructure. Google Safe Browsing has flagged the site for social engineering, indicating it is used to lure victims into providing credentials or personal data. VirusTotal reports that eight of ninety‑one scanned security vendors have marked the domain as malicious, reinforcing the suspicion of malicious intent. The domain is listed on a single security blocklist and has been actively blocked by the PhishDestroy feed, demonstrating that at least one community‑maintained blocklist considers it hostile.

DNS resolution points to the IP address 35.157.26.135, which is owned by Netlify’s hosting platform; the registrar information confirms the site was deployed through Netlify, a popular static‑site and serverless‑app provider. No authoritative nameserver records were returned (NS_NOT_FOUND), suggesting the domain relies on Netlify’s internal DNS handling rather than external delegation. No public SSL certificate details, HTTP status codes, or page title information are presently available, limiting visibility into the site’s transport security and content cues. Defenders should incorporate the domain into URL filtering rules, ensure that endpoint protection solutions reference the eight VirusTotal detections, and add the IP address 35.157.26.135 to network‑level blocklists.

Because the site is hosted on a shared cloud platform, blocking the entire Netlify range may cause collateral impact; instead, apply host‑based or URL‑specific policies. Continuous monitoring of the domain’s reputation via Google Safe Browsing, VirusTotal, and emerging blocklists is advised, as the infrastructure may evolve or spawn additional malicious subdomains. Organizations should educate users about unsolicited links that reference “xfinityconnnects” and encourage verification of legitimate Xfinity communications through official channels.