relieved-software-706324[.]framer[.]app

The domain relieved-software-706324.framer.app was identified as a phishing site specifically designed to impersonate the Xfinity login portal. Analysis confirms this as a case of brand impersonation, targeting users of the telecommunications service to harvest credentials. The domain is currently offline, though prior activity suggests it was actively serving malicious content. Infrastructure analysis reveals the domain was flagged by 12 of 95 security vendors on VirusTotal, indicating moderate to high confidence in its malicious nature. It was registered through Framer on March 11, 2026, and resolved to the IP address 31.43.160.6, hosted on infrastructure belonging to Amazon.com, Inc. (AS16509) in the Netherlands. The SSL certificate was issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious sites. The domain appeared on one security blocklist, and its page title, 'Xfinity Sign In,' further corroborates the intent to deceive users into entering sensitive information. Given the domain's current offline status, immediate risk to users is reduced. However, the infrastructure and tactics observed align with known phishing campaigns. Users who may have interacted with this domain should immediately reset their Xfinity credentials and enable multi-factor authentication. Organizations are advised to block the domain and associated IP at the network level, monitor for related indicators of compromise, and educate users on recognizing brand impersonation attempts. Security teams should review logs for connections to 31.43.160.6 and the domain to identify potential exposure.