comcastservice[.]webflow[.]io

comcastservice.webflow.io is a subdomain of webflow.io. PhishDestroy first recorded this hostname on Aug 6, 2026. Stored content metadata identifies Xfinity as the apparent target. The stored content classification is impersonation. The assembled evidence scores 100/100 (critical).

Three independent sources are positive: VirusTotal, Cloudflare Radar, and URLScan. On Aug 6, 2026 at 12:42 UTC, VirusTotal recorded 13 detections among 91 engines: BitDefender, ESET, Emsisoft, Fortinet, G-Data, Kaspersky, LevelBlue, Lionic, Netcraft, OpenPhish, Sophos, Webroot, ZeroFox; URLScan returned a malicious verdict with score 100. Cloudflare Radar classified the hostname as malicious and placed it in the phishing category; its verdict timestamp was not retained. The evidence is not unanimous. The external blocklist snapshot contained no matches on Aug 7, 2026 at 18:20 UTC. Google Safe Browsing returned no flag on Aug 6, 2026 at 12:42 UTC.

HTTP 200 was recorded on Aug 7, 2026 at 10:43 UTC. Registration records for the registrable domain webflow.io list Webflow, Inc. as the registrar. At collection time, the hostname resolved to 104.18.36.248 on AS13335 (Cloudflare, Inc.). The recorded endpoint location is Toronto, CA. The stored server header is cloudflare. Captured page title: “Comcastservice”. DOM analysis completed on Aug 6, 2026 at 14:20 UTC; stored DOM score 93/100. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and Cloudflare Radar. IoC extraction completed on Aug 7, 2026 at 04:00 UTC; stored 0 format-validated wallet addresses and 0 Telegram indicators. TLS metadata lists Google Trust Services as the certificate issuer with validity through Oct 23, 2026; checked Aug 6, 2026 at 13:02 UTC.

Taken together, the page content and independent findings support classifying this hostname as Xfinity-themed impersonation.