xfinityaccountupdates[.]webflow[.]io

Analysis on August 07, 2026 indicates that the domain xfinityaccountupdates.webflow.io is actively used in a credential phishing campaign. The domain resolves to the IPv4 address 104.18.36.248, which is associated with the Webflow hosting platform. Independent phishing blocklists have listed the domain; both PhishDestroy and OpenPhish currently block it. VirusTotal has recorded detections from 16 of 91 scanned security vendors, confirming that a subset of commercial scanners consider the site malicious.

The presence on two reputable blocklists together with multiple vendor detections suggests a high confidence that the domain is being leveraged to harvest user credentials, consistent with the elevated risk rating assigned. Publicly available intelligence does not disclose additional attributes such as registrar information, SSL certificate details, or the specific page title displayed by the site, limiting deeper attribution. Likewise, no data on the underlying phishing kit, targeted brand, or geographic hosting location beyond the IP address is provided. Consequently, the full scope of the campaign—including the number of victims, phishing lure, and any exfiltration infrastructure—remains uncertain.

Defenders should block any outbound HTTP/S traffic to xfinityaccountupdates.webflow.io at the network perimeter and add the domain to endpoint allow‑list exclusions for security products that rely on URL filtering. Email gateways should be configured to flag or quarantine messages containing URLs that resolve to this domain, and existing security information and event management (SIEM) rules should be updated to generate alerts on DNS queries for the domain. Organizations that monitor user credential exposure should treat any login attempts to this host as compromised and enforce password resets for affected accounts.