staging[.]booking-comuae-dubai-things-to-do[.]webflow[.]io

Analysis indicates that the domain staging.booking-comuae-dubai-things-to-do.webflow.io was registered on 12 June 2026 through the Webflow registrar and resolves to the IP address 172.64.151.8, which belongs to Cloudflare’s edge network. The domain is currently classified as an elevated‑risk generic phishing site and is listed as active. It has been blocked by the PhishDestroy mitigation service and appears on a single external security blocklist.

VirusTotal scans show that two of ninety‑one antivirus or URL‑reputation engines flagged the domain as malicious, providing independent but limited confirmation of its abusive nature. No additional public intelligence such as page title, SSL certificate details, or Safe Browsing verdicts is available in the supplied data, leaving the exact content and lure technique unverified. The combination of a recently created Webflow‑hosted subdomain, Cloudflare IP masking, and limited but positive vendor detections suggests a deliberate attempt to exploit the brand‑like string “booking‑comuae‑dubai‑things‑to‑do” for credential harvesting or redirection.

Defenders should add the domain to outbound‑filter deny lists, monitor DNS queries for the IP 172.64.151.8, and consider implementing sink‑hole redirects for traffic targeting this host. Continuous re‑evaluation is advised, as further analysis of the page payload or user‑agent logs may reveal additional indicators of compromise.