comcastupdatelogin[.]weebly[.]com

comcastupdatelogin.weebly.com is currently listed on a security blocklist and is actively blocked by PhishDestroy. The domain resolves to the IPv4 address 74.115.51.8. Analysis of public reputation services shows that nine of ninety‑one VirusTotal scanners have marked the domain as malicious, and Google Safe Browsing classifies it under social engineering. The registration record indicates the domain was provisioned through Square, Inc., a known service used by threat actors to obtain cheap or disposable registrations.

The subdomain is hosted on the free‑site platform weebly.com, which provides generic nameservers; in this case the expected nameserver entries are not resolvable (NS_NOT_FOUND). No SSL certificate details, HTTP status code, or page title have been disclosed, so the content of the site remains unverified. The limited visibility into the hosting environment, combined with the blocklist entry and multiple vendor detections, suggests that the domain is being used for credential‑phishing operations targeting Comcast customers, although the exact phishing page layout and credential capture mechanism have not been publicly observed. Defenders should block or sinkhole the domain at the network perimeter, add the IP address 74.115.51.8 to deny lists, and monitor outbound traffic for attempts to resolve or contact the host.

Endpoint detection rules that flag URLs containing “comcastupdatelogin” or the weebly.com subdomain pattern should be enabled. Because the registrar information is tied to Square, Inc., investigators may consider correlating other Square‑registered domains for potential campaign linkages. Continuous re‑scanning on VirusTotal and periodic checks against Google Safe Browsing are recommended to capture any changes in classification. Until further evidence emerges, the domain should be treated as high‑risk and active.