creative-backgrounds-489117[.]framer[.]app

This domain, creative-backgrounds-489117.framer.app, is identified as a credential phishing page targeting users of a major telecommunications provider. The page mimics the legitimate sign-in interface, designed to harvest login credentials by deceiving visitors into entering sensitive information under the guise of a trusted service. Analysis of the page title, 'Xfinity Sign In,' confirms the specific impersonation of a widely recognized internet and cable service provider, increasing the likelihood of successful social engineering attacks against its customer base.

Infrastructure analysis reveals multiple indicators of malicious intent. The domain resolves to the IP address 35.71.142.77, hosted under Amazon.com, Inc. (AS16509), and was registered through AT-88-Z (ASN: 16509). Security vendors on VirusTotal have flagged this domain, with 24 out of 95 detections confirming its phishing nature. Additionally, the domain appears on two security blocklists, including PhishDestroy and PhishingDB. The SSL certificate, issued by Let's Encrypt (serial number E7), does not mitigate the threat, as phishing sites commonly use valid certificates to appear legitimate.

Users who may have visited this domain or entered credentials are advised to take immediate action. First, revoke any entered credentials by changing passwords for the affected account and any other services where the same credentials may have been reused. Enable multi-factor authentication where available to add an additional layer of security. Monitor the account for unauthorized activity and report any suspicious transactions to the service provider. If financial or personal information was disclosed, consider placing a fraud alert on credit reports to prevent potential identity theft. Finally, ensure that endpoint security solutions are updated to detect and block similar threats in the future.