gray-thing-145447[.]framer[.]app

This domain, gray-thing-145447.framer.app, poses as an official Xfinity sign-in portal to deceive users into entering their credentials. Analysis indicates it is a brand impersonation phishing site designed to harvest login details, which could lead to unauthorized account access, financial fraud, or identity theft. The page mimics legitimate Xfinity authentication flows, increasing the likelihood of user deception. Infrastructure analysis reveals the domain was registered on February 21, 2026, through CSC Corporate Domains, Inc., an unusual registrar for consumer-facing phishing campaigns. It resolves to the IP address 52.223.52.2, hosted on Amazon Web Services (AS16509), and holds a Let's Encrypt SSL certificate (serial number E7). Detection data shows 21 out of 95 security vendors on VirusTotal flag this domain as malicious, with one confirmed blocklist entry. The page title explicitly reads 'Xfinity Sign In,' further confirming its fraudulent intent. Users who visited this domain should immediately change their Xfinity account passwords and enable multi-factor authentication if not already active. Monitor financial statements and credit reports for suspicious activity, as stolen credentials may be exploited across other platforms. Avoid reusing passwords from compromised accounts, and report the incident to the impersonated service provider for further investigation. If personal or payment details were entered, consider placing a fraud alert with credit bureaus.