comcast-connect[.]webflow[.]io

The domain comcast-connect.webflow.io is identified as a generic phishing site targeting Comcast customers. Analysis indicates it functions as a fraudulent login portal, designed to harvest user credentials under the guise of a legitimate service. The domain is currently offline, but prior activity suggests it posed an elevated risk to unsuspecting users attempting to access their accounts. Infrastructure analysis reveals the domain was flagged by 18 of 95 security vendors on VirusTotal, indicating broad detection as malicious. It was registered through MarkMonitor, Inc., a registrar commonly used for legitimate domains, which may have initially obscured its fraudulent nature. The domain resolved to the IP address 172.64.151.8 and was created on June 15, 2026, an unusually future-dated registration that may have been intended to evade immediate scrutiny. It appeared on one security blocklist and was issued an SSL certificate from Google Trust Services (WE1), providing a false sense of security to visitors. The page title, 'Comcast-connect,' further reinforces the impersonation of the legitimate Comcast brand. The domain has since been taken offline, but its prior existence highlights the ongoing threat of credential harvesting campaigns. Organizations and individuals are advised to monitor for similar domains using Comcast branding, particularly those hosted on webflow.io or resolving to shared infrastructure. Users who may have interacted with the site should immediately reset their Comcast credentials and enable multi-factor authentication. Network administrators should update blocklists to include this domain and its associated IP address, while security teams should investigate logs for any prior connections to 172.64.151.8. Future registrations with anomalous creation dates or hosting patterns resembling this incident should be treated with heightened scrutiny.