artsy-taxonomy-582688[.]framer[.]app

This domain, artsy-taxonomy-582688.framer.app, is identified as a credential theft phishing site impersonating Xfinity, a major telecommunications provider. The site is currently offline, but prior analysis confirms its use in harvesting user login credentials through a fraudulent sign-in portal. The page title, 'Xfinity Sign In,' directly mimics the legitimate Xfinity authentication interface, increasing the likelihood of successful deception against targeted users. Infrastructure analysis reveals the domain was registered through Framer on March 12, 2026, and resolves to the IP address 31.43.161.6, hosted on Amazon.com, Inc. infrastructure (AS16509) in the Netherlands. The domain is flagged by 21 of 95 security vendors on VirusTotal, and it appears on at least one security blocklist. The SSL certificate is issued by Let's Encrypt (serial number E7), a common choice for both legitimate and malicious domains. The creation date suggests potential premeditation, as the domain was established well in advance of typical phishing campaign deployment. Current status indicates the domain has been taken offline, likely due to detection and mitigation efforts. However, the infrastructure and registration details remain relevant for historical and proactive threat intelligence. Organizations and users are advised to block the domain at the network level, monitor for related indicators of compromise, and implement multi-factor authentication for Xfinity accounts to mitigate credential theft risks. Security teams should review logs for connections to 31.43.161.6 and the domain name to identify potential prior exposure. Given the brand impersonation and elevated detection rates, this domain warrants continued monitoring for resurgence or similar campaigns.