coonnect-xfinity-auth[.]weebly[.]com

This domain, coonnect-xfinity-auth.weebly.com, is identified as an Xfinity credential phishing site designed to harvest user login credentials through a fraudulent authentication interface. The page title, 'Sign in to xfinity,' mimics legitimate Xfinity login portals, increasing the likelihood of successful social engineering attacks against subscribers. Analysis indicates the site was crafted to exploit trust in the Xfinity brand, targeting customers who may inadvertently disclose sensitive account details, including usernames, passwords, and potentially multifactor authentication codes. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain resolves to IP address 74.115.51.9 and is hosted on Weebly infrastructure, utilizing technologies such as PHP, MySQL, and Cloudflare. It is registered through MarkMonitor, Inc., with a creation date of March 29, 2006, though the phishing content appears to be a recent addition. Security vendor detections on VirusTotal total 19 out of 95, and the domain appears on one security blocklist. The SSL certificate is issued by Let's Encrypt, providing a false sense of security to potential victims. Users who visited coonnect-xfinity-auth.weebly.com and entered credentials should immediately reset their Xfinity account passwords via the official Xfinity portal. Enable multifactor authentication if not already active. Monitor the account for unauthorized activity, including changes to contact information, payment methods, or linked services. If financial or personally identifiable information was submitted, consider placing a fraud alert with credit reporting agencies. Review connected devices and revoke access for any unrecognized sessions. Report the incident to the official abuse channels of the hosting provider and relevant consumer protection authorities.