wgkvwdubaibybookingcom[.]webflow[.]io

The domain wgkvwdubaibybookingcom.webflow.io was registered on June 12, 2026 through the Webflow platform, a service commonly used for rapid website deployment. DNS resolution points to the IP address 104.18.36.248, an address associated with Cloudflare's edge network, indicating the site is front‑ended by a content‑delivery service that can obscure the true origin of the hosting infrastructure. The domain has been actively blocked by the PhishDestroy detection engine, and it appears on a single external security blocklist, suggesting that at least one independent threat‑intelligence feed has flagged the host as malicious.

VirusTotal analysis shows that two out of ninety‑one scanning vendors have identified the domain as suspicious, providing limited but corroborating evidence of potential abuse. No further detail on the page title, SSL certificate, or HTTP response codes is available at this time, and no additional security‑vendor detections beyond the two flagged by VirusTotal have been disclosed. Because the domain is hosted on a shared CDN and was only created a month prior to the report date, its rapid appearance on blocklists indicates a likely intentional use for credential‑harvesting or other phishing‑related activity.

Defenders should update URL filtering policies to include wgkvwdubaibybookingcom.webflow.io, enforce DNS‑based blocking where feasible, and monitor outbound connections to the associated IP address for anomalous traffic patterns. Continuous re‑scanning of the domain with multiple sandbox and reputation services is recommended to capture any escalation in detection scores, and any observed malicious payloads should be shared with upstream threat‑intel platforms to enrich community defenses.