phishunt.io flags Xfinity phishing page hosted at xfinity-145t.square.site
phishunt.io flagged xfinity-145t.square.site on 31 October 2026 as a phishing page copying the Xfinity sign-in screen. Xfinity and Comcast are not involved; the page sits on a site-builder subdomain.
- First reported
- Reports
- 1
Source: x.com · published
What happened
phishunt.io, an automated phishing-detection feed, posted on X on 31 October 2026 that it had detected a phishing page impersonating Xfinity, the Comcast broadband and TV brand. The page is at xfinity-145t.square.site. The post lists the IP address as 74.115.51.5 on Weebly's network (AS27647) in the United States. Xfinity and Comcast are not involved. square.site is the address space used by Square's website builder, so the subdomain is the phishing page, while the platform itself is a legitimate service.
How the scam works
The screenshot attached to the post shows a page that imitates the Xfinity sign-in screen. It has an Xfinity logo, the heading “Sign in with your Xfinity ID”, an “Email, mobile, or username” field, a password field and a “Next” button. At the bottom it carries Square's “Powered by Square” footer, which a real Xfinity page would not. A page like this is built to capture the visitor's Xfinity ID and password. Account details can then be used to change the account, read associated email, pick up billing details or try the same password on other services.
Free and low-cost site builders are attractive to phishers because the hosting is cheap, the address looks like a normal business site and the platform's own reputation can help a page slip past some filters. The domain name here includes “xfinity” and a number, but the part that matters is square.site at the end. Real Xfinity sign-in pages are served from Comcast's own domains such as xfinity.com.
On 31 October 2026 scammers.com checked the Phishing Army blocklist and found xfinity-145t.square.site listed. A blocklist entry is a warning flag, not a court finding.
Source
phishunt.io post on X, 31 October 2026 (screenshot and indicators), with the domain's Phishing Army blocklist status checked by scammers.com the same day.
Red flags
- An Xfinity sign-in page on an address ending in square.site rather than xfinity.com.
- A sign-in form with a “Powered by Square” footer.
- A web address built from the brand name plus random characters, such as xfinity-145t.
- An email or text about your account, billing or service that links to a sign-in page.
- A page asking for your username and password but showing no real account content.
If you were targeted
- 1Do not sign in on xfinity-145t.square.site.
- 2If you entered your Xfinity ID or password, change it now on the official xfinity.com site and anywhere else you reuse it.
- 3Turn on two-step verification for your Xfinity account.
- 4Open Xfinity only by typing the address or using its app, not through links in messages.
- 5Report phishing to Comcast through its official channels and to the FTC at reportfraud.ftc.gov.