spiky-lottery-629084[.]framer[.]app

The domain spiky-lottery-629084.framer.app was registered through CSC Corporate Domains, Inc. on October 2, 2020 and currently resolves to the Amazon-owned IP address 35.71.142.77 (AS16509). The site presents a page title of "Xfinity Sign In" and is classified as a credential phishing campaign targeting the Xfinity brand. Infrastructure analysis shows the site was built on Framer Sites and React, with security headers indicating HSTS and support for HTTP/3. The TLS certificate is issued by Let’s Encrypt (E7), confirming the use of a publicly trusted certificate despite the malicious intent.

An HTTP request to the host returns a 404 status, and the domain is presently taken offline, yet it remains listed on at least one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans have recorded detections by 15 of 95 security vendors, reinforcing the malicious assessment. Nameservers are hosted on AWS Route 53 (ns-1371.awsdns-43.org, ns-51.awsdns-06.com, ns-2002.awsdns-58.co.uk, ns-625.awsdns-). The evidence indicates a deliberate brand impersonation effort rather than a generic scam, with the primary objective to harvest Xfinity credentials.

Uncertainty remains regarding any additional payloads or post‑compromise activities, as no page content beyond the title has been captured. Defenders should immediately add the domain and its associated IP to inbound and outbound blocklists, monitor DNS queries to the listed nameservers for related patterns, and ensure that web filtering solutions flag any attempt to access URLs containing "Xfinity Sign In" under this host. Continuous threat‑intel feeds should be consulted for any resurgence, and incident response teams should be prepared to investigate any credential submissions that may have been directed to this infrastructure.