comcastservice[.]webflow[.]io

This domain, comcastservice.webflow.io, is currently flagged as an active generic phishing threat as of August 06, 2026, with a high risk level. Infrastructure analysis shows the domain resolves to IP address 104.18.36.248, which is consistent with hosting services provided by Webflow, Inc., the registrar for this subdomain. The domain appears on one security blocklist, specifically PhishDestroy, and VirusTotal data indicates that 13 out of 91 security vendors currently flag this domain as malicious or suspicious. No nameservers were found for this domain, which is an unusual configuration and may complicate standard DNS-based takedown or analysis procedures.

The exact content hosted on this page has not yet been analyzed, so the specific brand impersonated or the nature of the phishing lure cannot be confirmed from the available intelligence. Defenders should treat this domain as compromised infrastructure actively used for phishing operations. Immediate actions include blocking the domain at the DNS and proxy levels, adding the IP address 104.18.36.248 to threat intelligence feeds, and monitoring for any related subdomains or variations under the webflow.io domain.

Given the low blocklist presence but relatively high vendor detection rate, this domain may be newly deployed or part of a targeted campaign. Organizations should review logs for any interactions with this domain, especially if users have received unsolicited communications referencing Comcast or related services, though no specific brand target is confirmed. Continued monitoring is recommended, as the domain remains active and could be leveraged for credential harvesting or malware distribution.