comcastconnect[.]webflow[.]io

The domain comcastconnect.webflow.io is currently active and has been identified as a credential‑harvest phishing infrastructure. Analysis shows the domain resolves to the IP address 172.64.151.8 and is hosted on the Webflow, Inc. platform, which is also listed as the registrar. The domain’s authoritative name servers could not be retrieved (NS_NOT_FOUND), indicating that DNS configuration details are limited.

PhishDestroy has blocked the domain, and it appears on one external security blocklist, confirming that at least one reputable sinkhole has taken mitigation action. VirusTotal reports that 11 of 91 security vendors have flagged the domain, providing independent corroboration of malicious intent. No further public evidence such as page titles, SSL certificate details, HTTP response codes, or Safe Browsing verdicts is presently available, leaving the visual content and exact phishing lure unverified.

Defenders should treat any traffic to this host as hostile: block the domain at perimeter firewalls, DNS resolvers, and proxy layers; monitor outbound connections to the IP 172.64.151.8 for signs of data exfiltration; and update endpoint detection rules to include the domain hash and observed network indicators. Given the limited visibility into the site’s payload, continued threat‑intel collection is advised to capture any future changes to the hosting environment, additional blocklist listings, or emerging detection signatures.