store[.]comdubaibooking[.]webflow[.]io

store.comdubaibooking.webflow.io was identified as part of an active phishing operation on July 29 2026. The domain resolves to the address 104.18.36.248, which is hosted on a large content‑delivery network commonly used for rapid deployment of malicious sites. Registration occurred on June 12 2026 through the Webflow service, indicating a short lifespan that is typical for campaigns seeking to evade long‑term detection. The domain is listed on a single security blocklist and is explicitly blocked by the PhishDestroy filtering engine, providing an independent confirmation of malicious intent.

VirusTotal scans have returned three positive detections out of ninety‑one vendors, reinforcing the suspicion despite a modest detection ratio. No public information about the SSL certificate, HTTP status code, or page title has been released, so the exact visual content, credential‑harvesting technique, or targeted brand remains unknown. The combination of recent creation, CDN hosting, and limited but consistent detection points to a deliberately short‑lived phishing infrastructure that may be used to lure victims before reputation‑based defenses can adapt.

Given the elevated risk rating and active status, defenders should add the domain to DNS‑level blocklists, enforce outbound filtering of the associated IP, and monitor network traffic for anomalous connections to the CDN address. Email security gateways should be tuned to flag messages containing the domain or similar sub‑domains, and user awareness training should emphasize scrutiny of unexpected booking‑related links. Continuous collection of additional telemetry—such as future VirusTotal scans, blocklist updates, or observed payloads—will be essential for refining the threat assessment and guiding further mitigation steps.