Wildcard PoC — attacker-chosen hostname login.docs.ems.eos.comcast.com under *.docs.ems.eos.comcast.com.
Demonstrates an attacker can serve content on ANY convincing hostname (e.g. login/sso/secure) on a comcast.com origin. Authorized research. Thu 18 Jun 12:23:56 UTC 2026