# PhishDestroy domain threat record: duubaiiimuseumm.webflow.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/duubaiiimuseumm.webflow.io/ Machine-readable companion: https://phishdestroy.io/domain/duubaiiimuseumm.webflow.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-16 16:40:08 UTC - Last availability or vendor check: 2026-10-21 01:16:17 UTC - Stored record updated: 2026-10-22 14:22:01 UTC - VirusTotal detections in the stored snapshot: 13/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 172.64.151.8 - Registrar in stored WHOIS data: MarkMonitor Inc. - Last stored HTTP status: 404 - Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/duubaiiimuseumm.webflow.io - Certificate Transparency search: https://crt.sh/?q=%25.duubaiiimuseumm.webflow.io - Web Archive lookup: https://web.archive.org/web/*/https://duubaiiimuseumm.webflow.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview duubaiiimuseumm.webflow.io is a subdomain on Webflow's free site-builder space whose name is a padded, misspelled form of "Dubai museum," a spelling pattern often used to dodge filters or mimic a legitimate name. PhishDestroy first saw it on 2026-09-16 and added it to our blocklist. The site went dead on 2026-09-21 and was still serving nothing at its root when last checked on 2026-10-19. The page title reads "404 - Page not found," which shows the content has been removed, while the domain remains listed by us as suspicious. How the scam works No live page remains, so the exact lure cannot be confirmed. A throwaway subdomain with a deliberately mangled name, flagged by over a dozen security engines within a week of appearing, fits the profile of short-lived pages used to collect personal or payment details or to redirect visitors elsewhere. Anyone who reached it through a link promising tickets, bookings or offers tied to a Dubai attraction should treat whatever they entered there as potentially exposed. Evidence On 2026-09-23, 13 of 89 VirusTotal engines flagged the domain, including ESET, BitDefender, Fortinet, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, CyRadar and LevelBlue. That is a meaningful spread of independent vendors for a site that lived only a few days, and it backs the decision to block it. Among public blocklists, only PhishDestroy lists it. Infrastructure Because it sits on a Webflow subdomain, the operator needed no domain registration of their own, only a free account, which makes such pages fast to create and easy to abandon. Traffic resolves through Cloudflare, Inc. at 172.64.151.8, geolocated to Canada, the shared front-end that serves many Webflow sites. The roughly five-day lifespan between first sighting on 2026-09-16 and going offline on 2026-09-21 points to a disposable page rather than a lasting project. What to do If you entered a password on this site, change it wherever you reuse it and turn on two-factor authentication. If you submitted card or bank details, contact your bank to block the card and watch for unfamiliar charges. Be wary of follow-up emails or messages that reference a booking or purchase you made through it. Defenders should block the full subdomain, search mail and proxy logs for visits since 2026-09-16, and report similar Webflow subdomains with distorted brand or place names to Webflow for removal. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/duubaiiimuseumm.webflow.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=duubaiiimuseumm.webflow.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:52:18 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/1b7df0a5-0fbf-4fd0-8737-304776e6120d.png Captured: 2026-09-23 04:11:19 UTC Source report: https://radar.cloudflare.com/scan/1b7df0a5-0fbf-4fd0-8737-304776e6120d SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:57Z", "uuid": "1b7df0a5-0fbf-4fd0-8737-304776e6120d", "scanned_at": "2026-09-23T04:11:19Z", "final_url": "https://duubaiiimuseumm.webflow.io/", "status": 404, "history": [ { "url": "https://duubaiiimuseumm.webflow.io/", "status": 404 } ], "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488", "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "duubaiiimuseumm.webflow.io", "type": "A", "value": "172.64.151.8" }, { "name": "duubaiiimuseumm.webflow.io", "type": "A", "value": "104.18.36.248" }, { "name": "duubaiiimuseumm.webflow.io", "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "name": "duubaiiimuseumm.webflow.io", "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" } ], "dnssec_valid": false, "ip": "172.64.151.8", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "expires": "2028-05-08T02:20:57Z", "nameservers": [ "lamar.ns.cloudflare.com", "journey.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:28:58Z", "analysis_at": "2026-10-13T09:39:00Z", "stats": { "timeout": 0, "harmless": 47, "malicious": 14, "suspicious": 0, "undetected": 31 }, "detections": { "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "SOCRadar": "phishing", "LevelBlue": "phishing", "PhishFort": "malicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "expires": "2028-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "first_seen": "2026-09-16T13:48:16Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" }, { "ttl": 300, "type": "A", "value": "104.18.36.248" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "ttl": 300, "type": "A", "value": "172.64.151.8" } ], "dns_at": "2026-10-13T09:45:32Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "webflow.io", "*.webflow.io" ], "issuer": "Google Trust Services / WE1", "serial": "ac972ef95a18ab8f0e5a2917e958d6da", "sha256": "5302eb12d2c1ddc8020e4565aef253a59e28b4a9aede60f73e4fe6cb516fd2a7", "subject": "webflow.io", "valid_to": "2026-12-21T03:46:57Z", "valid_from": "2026-09-22T02:47:08Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2013-05-08T02:20:57Z", "updated": "2025-02-25T20:53:31Z", "expires": "2028-05-08T02:20:57Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "journey.ns.cloudflare.com", "lamar.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```