# PhishDestroy domain threat record: maadame---tusssauds-duubai.webflow.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/maadame---tusssauds-duubai.webflow.io/ Machine-readable companion: https://phishdestroy.io/domain/maadame---tusssauds-duubai.webflow.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-16 16:40:08 UTC - Last availability or vendor check: 2026-10-21 01:16:25 UTC - Stored record updated: 2026-10-22 14:23:14 UTC - VirusTotal detections in the stored snapshot: 14/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 104.18.36.248 - Registrar in stored WHOIS data: MarkMonitor Inc. - Last stored HTTP status: 404 - Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/maadame---tusssauds-duubai.webflow.io - Certificate Transparency search: https://crt.sh/?q=%25.maadame---tusssauds-duubai.webflow.io - Web Archive lookup: https://web.archive.org/web/*/https://maadame---tusssauds-duubai.webflow.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview This was an impersonation phishing page built on a free Webflow subdomain. Its padded, misspelled name imitates Madame Tussauds Dubai, the wax museum attraction. PhishDestroy first saw it on 2026-09-16. The site went offline on 2026-09-22 and was still dead with no content at its root on 2026-10-19. How the scam works Fake attraction pages like this one usually copy the venue's branding and offer tickets, discounts or giveaways. They then collect card details, personal data or direct payments that never turn into a valid booking. The doubled and tripled letters in the hostname help it slip past casual readers who only skim a link in an ad, message or search result. The page title now reads "404 - Page not found," which reflects the removed content rather than the impersonation PhishDestroy classified. Evidence On 2026-09-23, 14 of 89 VirusTotal engines flagged the address. This is a meaningful consensus for a short-lived page on a shared builder domain. Vendors behind the verdict include alphaMountain.ai, BitDefender, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data and LevelBlue. The domain is also listed on the PhishDestroy blocklist. Infrastructure The operator did not register a domain at all. They used a webflow.io subdomain, which costs nothing and inherits the platform's reputation and valid HTTPS. Traffic resolved to Cloudflare, Inc. addresses located in Canada, which is standard for Webflow-hosted sites. The page went dark six days after PhishDestroy first saw it, a typical lifespan for throwaway builder pages. What to do If you paid for tickets or entered card details on this page, contact your bank to dispute the charge and request a replacement card. If you gave it your email, phone number or passport details, watch for follow-up scams that reuse them. Change any password you typed there and enable two-factor authentication on that account. Buy Madame Tussauds Dubai tickets only through the venue's official site or established resellers. Defenders should block the hostname and treat look-alike webflow.io subdomains carrying attraction brands as suspicious. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/maadame---tusssauds-duubai.webflow.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=maadame---tusssauds-duubai.webflow.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:18:03 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/4b466fe6-fb07-4172-96ac-d6dd8a4fca2c.png Captured: 2026-09-23 04:16:29 UTC Source report: https://radar.cloudflare.com/scan/4b466fe6-fb07-4172-96ac-d6dd8a4fca2c SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aabb-7e9b-746e-810d-bedd3ba8b958.png Captured: 2026-09-16 15:00:15 UTC Source report: https://urlscan.io/result/01a0aabb-7e9b-746e-810d-bedd3ba8b958/ SHA-256: eb5c94cb6493d810acd574bcc580f4dd214793336d58e0cc2f1c37cef86be766 - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aabb-7a39-7421-bb16-9ec49dec2b4f.png Captured: 2026-09-16 15:00:17 UTC Source report: https://urlscan.io/result/01a0aabb-7a39-7421-bb16-9ec49dec2b4f/ SHA-256: eb5c94cb6493d810acd574bcc580f4dd214793336d58e0cc2f1c37cef86be766 - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0af11-fc10-7494-9bcc-64552b20cf3e.png Captured: 2026-09-17 11:13:13 UTC Source report: https://urlscan.io/result/01a0af11-fc10-7494-9bcc-64552b20cf3e/ SHA-256: eb5c94cb6493d810acd574bcc580f4dd214793336d58e0cc2f1c37cef86be766 - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd3b-3ad0-701c-bc42-8b5680906eb1.png Captured: 2026-09-23 07:46:51 UTC Source report: https://urlscan.io/result/01a0cd3b-3ad0-701c-bc42-8b5680906eb1/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd3b-39fc-7638-9883-4d90c399520e.png Captured: 2026-09-23 07:46:52 UTC Source report: https://urlscan.io/result/01a0cd3b-39fc-7638-9883-4d90c399520e/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 - URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d93f-a0a7-7392-b347-524ed49d9f05.png Captured: 2026-09-25 15:47:23 UTC Source report: https://urlscan.io/result/01a0d93f-a0a7-7392-b347-524ed49d9f05/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:46Z", "uuid": "4b466fe6-fb07-4172-96ac-d6dd8a4fca2c", "scanned_at": "2026-09-23T04:16:29Z", "final_url": "https://maadame---tusssauds-duubai.webflow.io/", "status": 404, "history": [ { "url": "https://maadame---tusssauds-duubai.webflow.io/", "status": 404 } ], "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488", "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "maadame---tusssauds-duubai.webflow.io", "type": "A", "value": "104.18.36.248" }, { "name": "maadame---tusssauds-duubai.webflow.io", "type": "A", "value": "172.64.151.8" }, { "name": "maadame---tusssauds-duubai.webflow.io", "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "name": "maadame---tusssauds-duubai.webflow.io", "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" } ], "dnssec_valid": false, "ip": "104.18.36.248", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "expires": "2028-05-08T02:20:57Z", "nameservers": [ "lamar.ns.cloudflare.com", "journey.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:28:15Z", "analysis_at": "2026-10-16T15:42:28Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 13, "suspicious": 0, "undetected": 33 }, "detections": { "ESET": "phishing", "VIPRE": "phishing", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "LevelBlue": "phishing", "Seclookup": "malicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "expires": "2028-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "first_seen": "2026-09-16T14:25:24Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "ttl": 300, "type": "A", "value": "172.64.151.8" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" }, { "ttl": 300, "type": "A", "value": "104.18.36.248" } ], "dns_at": "2026-10-16T15:47:43Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "webflow.io", "*.webflow.io" ], "issuer": "Google Trust Services / WE1", "serial": "ac972ef95a18ab8f0e5a2917e958d6da", "sha256": "5302eb12d2c1ddc8020e4565aef253a59e28b4a9aede60f73e4fe6cb516fd2a7", "subject": "webflow.io", "valid_to": "2026-12-21T03:46:57Z", "valid_from": "2026-09-22T02:47:08Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2013-05-08T02:20:57Z", "updated": "2025-02-25T20:53:31Z", "expires": "2028-05-08T02:20:57Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "journey.ns.cloudflare.com", "lamar.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```