xfinitymailmkd[.]weebly[.]com

xfinitymailmkd.weebly.com is a subdomain of weebly.com. PhishDestroy first observed the hostname on Jun 15, 2026. The hostname explicitly references Xfinity; stored content metadata identifies the same apparent target. The captured page title is “Home”. Current evidence score: 100/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, DNS security resolvers, Cloudflare Radar, and URLScan. VirusTotal recorded 18 detections among 91 engines: alphaMountain.ai, BitDefender, Chong Lua Dao, CyRadar, ESET, Emsisoft, Fortinet, G-Data, Google Safebrowsing, Gridinsoft, Kaspersky, LevelBlue, Lionic, Netcraft, Sophos, VIPRE, Webroot, ZeroFox on Jul 18, 2026 at 16:45 UTC. DNS security checks returned 6 blocking results across 14 tested policies: Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware, Quad9 Secure; no observation timestamp was retained. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. URLScan returned a malicious verdict with score 100; scan metadata linked the capture to Xfinity and assigned phishing as its category on Jul 29, 2026 at 03:03 UTC. Non-positive and contextual checks: The external blocklist snapshot contained no matches on Aug 7, 2026 at 22:20 UTC. Google Safe Browsing returned no flag on Jun 13, 2026 at 00:35 UTC.

HTTP 404 was recorded on Aug 7, 2026 at 01:08 UTC; content was unavailable. Registration records for the registrable domain weebly.com list MarkMonitor, Inc. as the registrar and Jun 12, 2026 as the creation date. Registration preceded first observation by 2 days. At collection time, the hostname resolved to 74.115.51.9 on AS27647 (Weebly, Inc.). The IP and ASN identify shared Cloudflare edge infrastructure; the origin server is not established by this address. The evidence archive retains 1 visual capture from PhishDestroy. TLS metadata lists Let's Encrypt as the certificate issuer with validity through Sep 8, 2026; checked Jun 12, 2026 at 16:00 UTC.

The content indicators and 4 positive source findings support the current Xfinity impersonation and phishing classification. The target field identifies Xfinity, but the record does not establish whether the page requested credentials, a seed phrase, or a wallet connection.