xfinityservicehtmls[.]weebly[.]com

This domain, xfinityservicehtmls.weebly.com, is flagged as a credential theft operation targeting Xfinity users. Analysis indicates the site impersonates the legitimate Xfinity sign-in portal, presenting a fraudulent login interface designed to harvest user credentials. The threat actor leverages brand impersonation tactics, specifically mimicking Comcast’s Xfinity authentication flow, to deceive victims into submitting sensitive account details. No evidence of a crypto drainer or payment skimming component was observed, distinguishing this as a pure credential harvesting campaign. Infrastructure analysis reveals multiple technical indicators of compromise. The domain was registered through MarkMonitor, Inc. on May 04, 2026, an anomalous future date suggesting potential domain spoofing or registry manipulation. It resolves to the IP address 74.115.51.9, hosted by Weebly, Inc. in the United States. VirusTotal reports 22 out of 95 security vendors flagging the domain as malicious, while it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate is issued by Let’s Encrypt (serial number E8), a common tactic to lend superficial legitimacy to phishing infrastructure. The domain is currently offline, likely taken down in response to detection or enforcement actions. However, residual risk persists due to the potential for the threat actor to re-deploy the infrastructure under a new domain or hosting provider. Users who interacted with the site should immediately reset their Xfinity credentials, enable multi-factor authentication, and monitor accounts for unauthorized activity. Organizations are advised to block the domain and associated IP at the network level and conduct retrospective log analysis to identify any prior compromise attempts.