payment[.]booking-comarab-dubai-shopping[.]webflow[.]io

Analysis indicates that the domain payment.booking-comarab-dubai-shopping.webflow.io was registered on June 12, 2026 through the Webflow platform, a popular SaaS website builder that often hosts legitimate content as well as abuse. The domain resolves to the IP address 172.64.151.8, which belongs to the Cloudflare network and is commonly shared among many unrelated sites, limiting attribution based solely on the hosting provider. Reputation data show that the domain appears on a single public security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that at least one threat‑intel source has observed malicious activity associated with it. VirusTotal reports that 2 of 91 scanned security vendors have flagged the domain, providing additional, albeit limited, evidence of suspicious behavior.

The threat type is classified as generic phishing, and the risk level is elevated, with the current status marked as active as of the report date (July 29, 2026). No public information on SSL certificate details, HTTP response codes, page title, or content analysis is available, leaving the visual or functional characteristics of the site unverified. Consequently, defenders cannot confirm the exact phishing lure or target brand without further investigation. The lack of broader blocklist coverage and the relatively low detection count suggest that the campaign may be in an early stage or employing a low‑profile hosting strategy.

Defensive recommendations include adding the domain to local deny lists, monitoring DNS queries for the IP 172.64.151.8 and the associated hostname, and configuring web proxy or secure web gateway rules to block HTTP/S requests to the domain. Continuous re‑scanning on VirusTotal or similar multi‑engine services is advised to capture any changes in detection status. Organizations should also consider leveraging threat‑intel feeds that reference PhishDestroy to enrich detection pipelines.