dubaibooking-com[.]webflow[.]io

On 29 July 2026 the domain dubaibooking-com.webflow.io was recorded as an active generic phishing site with an elevated risk rating. The domain was created on 12 June 2026 through the Webflow registrar, indicating that the adversary leveraged a legitimate website‑building service to obtain a seemingly benign hostname. DNS lookup resolves to the single IPv4 address 172.64.151.8, an endpoint within Cloudflare’s infrastructure that is commonly used by malicious operators to obtain rapid hosting and benefit from shared mitigation services.

The domain is listed on one public security blocklist and is explicitly blocked by the PhishDestroy feed, providing early evidence of its malicious classification. VirusTotal scans returned five positive detections out of ninety‑one submitted scanners, confirming that multiple independent engines have flagged the domain as suspicious. No additional metadata such as page title, target brand, SSL certificate details, or HTTP response codes has been released, leaving the exact content of the hosted page unverified.

The limited number of blocklist entries and modest detection count suggest that the campaign may be in a nascent phase or employing fast‑flux style rotation of domains. Defenders should immediately add dubaibooking-com.webflow.io to local deny lists, monitor for DNS queries to the associated Cloudflare IP, and apply outbound filtering rules to restrict connections to untrusted Cloudflare‑hosted domains. Continuous re‑assessment is advised, as further detections, additional blocklist listings, or new intelligence could emerge as the threat actor expands the operation.