incomparable-empathy-657885[.]framer[.]app

Analysis of the domain incomparable-empathy-657885.framer.app indicates a credential-phishing campaign impersonating Xfinity, a telecommunications brand. The domain, registered through CSC Corporate Domains, Inc. on October 2, 2020, resolves to IP address 35.71.142.77, hosted on Amazon Web Services (AS16509) in the United States. Infrastructure analysis reveals the use of Framer Sites and React, alongside security headers such as HSTS and HTTP/3. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and does not inherently indicate compromise.

The page title, 'Xfinity Sign In,' aligns with the reported brand impersonation, suggesting an attempt to harvest user credentials by mimicking an official Xfinity login portal. As of July 24, 2026, the domain is offline, returning an HTTP 404 status. Prior to takedown, it was flagged by one security blocklist (PhishDestroy) and detected by 16 of 95 security vendors on VirusTotal, corroborating its classification as a phishing threat. The nameservers—ns-625.awsdns-14.net, ns-2002.awsdns-58.co.uk, ns-51.awsdns-06.com, and ns-1371.awsdns-46.org—are associated with AWS, a frequent hosting provider for both benign and malicious content.

Defenders should treat this domain as a confirmed phishing resource targeting Xfinity customers. While the site is currently offline, the infrastructure remains registered and could be reactivated. Organizations are advised to block the domain and IP at perimeter defenses, monitor for reuse of the same AWS-hosted infrastructure, and alert users to the credential-phishing risk associated with this campaign. Further investigation into the registrar’s abuse response and AWS’s hosting policies may aid in preventing similar threats.