xfinity[.]payment-profile[.]info

On July 31, 2026, the domain xfinity.payment-profile.info was identified as active infrastructure supporting a generic phishing operation. DNS resolution points to the IPv4 address 212.193.3.175; no nameserver records were returned, indicating that the authoritative NS entries are missing or deliberately concealed. The domain has been added to the PhishDestroy blocklist and appears on an additional security blocklist, confirming that at least two independent threat‑filtering services have flagged it.

VirusTotal scans show that five of ninety‑one AV and URL scanners reported the domain as malicious, providing modest but corroborating detection evidence. No public Safe Browsing, Open Threat Exchange, or registrar reputation data were supplied, and no SSL certificate details, HTTP response codes, or page titles have been published, leaving the surface‑web characteristics unverified. The limited observable artifacts suggest a low‑cost phishing kit hosted on a single IP address, possibly shared with other malicious actors.

Defenders should update network and email filtering policies to block resolution to 212.193.3.175 and add xfinity.payment-profile.info to existing blocklists. Continuous monitoring of the IP and any future DNS changes is recommended, as the lack of visible nameserver information may indicate rapid re‑hosting. Threat intelligence consumers should treat the domain as high‑risk until further forensic analysis confirms its payload or victim targeting.