dev[.]bokingcodubai[.]webflow[.]io

The domain dev.bokingcodubai.webflow.io was created on June 12, 2026 and is registered through the Webflow platform, indicating that the infrastructure is hosted on a legitimate website‑building service. DNS resolution points to the IP address 104.18.36.248, a host that is shared among many Webflow‑hosted sites and does not, by itself, suggest malicious intent. Nonetheless, the domain is classified as a generic phishing threat with an elevated risk rating and is currently active. Defensive telemetry shows that the domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service.

VirusTotal analysis records a single positive detection out of 91 security vendors, confirming that at least one vendor has identified malicious behavior associated with the domain. No additional public intelligence such as Safe Browsing entries, Open Threat Exchange references, or page‑title analysis is available at this time. The limited detection footprint suggests that the campaign may be in an early stage or employing low‑visibility techniques.

Defenders should prioritize adding the domain to URL filtering rules and ensure that any outbound traffic to the associated IP is monitored. Continuous re‑evaluation is advised, as further detections or blocklist inclusions could indicate escalation. Organizations using Webflow‑based hosting should verify that legitimate subdomains are not inadvertently conflated with this malicious indicator, and incident response teams should be prepared to isolate any credential‑capture activity that may be linked to this domain.