melodious-manatee-c2a637[.]netlify[.]app

The domain melodious-manatee-c2a637.netlify.app is actively used for credential phishing, impersonating Xfinity's sign-in page. It is flagged as malicious by 18 out of 91 vendors on VirusTotal, indicating significant recognition of its threat. Google Safe Browsing also marks it as unsafe, and it appears on public blocklists including PhishDestroy and OpenPhish.

Registered via Netlify and hosted on an Amazon.com, Inc. IP address in Germany, the site uses a DigiCert-issued SSL certificate. This setup may lend an appearance of legitimacy to unsuspecting users. The platform risk score is a perfect 100/100, highlighting the high threat level posed by this operation.

Despite its active status, the domain's abuse score is relatively low at 19/100, suggesting limited reports of abuse so far. However, the phishing operation's effectiveness is underscored by its early detection on June 22, 2026, by PhishDestroy. This detection is crucial, as it helps mitigate the risk during the critical early period before full propagation across all security vendors.

The domain's mimicry of Xfinity's branding is a common tactic to deceive users into submitting their credentials. This highlights the ongoing risk of phishing attacks leveraging trusted brands to exploit user trust. Continuous monitoring and timely reporting are essential in combating such threats.