booking-----comsdubai[.]webflow[.]io

Analysis of the domain booking-----comsdubai.webflow.io indicates that it is actively being used for phishing. The domain resolves to IP address 104.18.36.248 and was first registered on June 12, 2026 through the Webflow platform, a service that provides both site‑building tools and DNS hosting. The recent registration date, combined with the use of a reputable hosting provider, is a pattern often seen in rapid‑deployment phishing campaigns. The domain has been added to at least one security blocklist and is specifically listed as blocked by the PhishDestroy mitigation service, reinforcing the assessment of malicious intent.

VirusTotal scans show that two out of ninety‑one security vendors flagged the domain, providing independent confirmation of its suspicious nature. No additional intelligence such as page titles, Safe Browsing verdicts, or public OTX references is currently available, leaving the exact content of the hosted page unverified. Nevertheless, the convergence of registration data, IP resolution, blocklist inclusion, and vendor detections justifies an elevated risk rating and the classification of this site as a confirmed phishing gateway.

Defensive teams should immediately add booking-----comsdubai.webflow.io to URL filtering rules and consider blocking outbound traffic to the associated IP address. Continued monitoring of the IP range and any newly observed subdomains is advisable, as attackers frequently leverage the same hosting infrastructure for subsequent campaigns. Organizations are also encouraged to update endpoint protection signatures to incorporate the two vendors that have already identified this domain as malicious, ensuring broader coverage against potential exploitation.