The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #131) that hxxps://sign-in-to-xfinity-3643.weebly.com/ is a phishing page impersonating Xfinity, the Comcast internet, TV and m…
Source: x.com · published
The phishing-alert account @TheThreatWire posted on X on 10 November 2026 (Phishing Alert #131) that hxxps://sign-in-to-xfinity-3643.weebly.com/ is a phishing page impersonating Xfinity, the Comcast internet, TV and mobile brand in the United States. weebly.com is a shared website-builder domain; only this subdomain is reported here, and Weebly and Comcast are not the operators. Xfinity customers should sign in only through the Xfinity app or by typing xfinity.com themselves.
Xfinity-themed look-alike pages typically arrive in emails or texts that claim a bill is overdue, a service outage needs attention or an account will be suspended unless the customer signs in. The address sign-in-to-xfinity-3643.weebly.com is a page on the Weebly site builder, not on xfinity.com. A password or one-time code entered there is sent to whoever created the subdomain, not to Comcast.
Weebly and similar hosts are frequently abused because anyone can publish a page in minutes. Only this subdomain is reported here; Weebly and Comcast are not the operators. Sign in only through the Xfinity app or by typing xfinity.com yourself. The alert comes from a public tracker post and has not been independently checked by scammers.com.
Comcast and Xfinity publish official account tools on xfinity.com and in their apps. A Weebly subdomain, even one that uses the brand name in full, is not an official sign-in page, and a request to hurry because service will be cut off is a common pressure tactic.
Public post on X, 10 November 2026: https://x.com/TheThreatWire/status/2120051051466457482
The indicators come from this source and have not been independently checked by scammers.com.
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that ago-alefpa[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's screenshot s…
Automated URL scanner urlDNA posted on Mastodon (infosec.exchange) on 11 November 2026 that mail-premium-updatess[.]weebly[.]com is a possible phishing page; the host is also on the Phishing Army blocklist. urlDNA's s…
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
URL-analysis service urlDNA (@urldna@infosec.exchange) posted on Mastodon on 12 November 2026 that hxxps://rdkyle[.]wixsite[.]com/my-site is possible phishing. The screenshot it captured shows a Wix-built page reading…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…