# PhishDestroy domain threat record: tussaudsdubai----madame.webflow.io Content language: English Canonical HTML report: https://phishdestroy.io/domain/tussaudsdubai----madame.webflow.io/ Machine-readable companion: https://phishdestroy.io/domain/tussaudsdubai----madame.webflow.io/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-16 16:40:08 UTC - Last availability or vendor check: 2026-10-21 01:16:23 UTC - Stored record updated: 2026-10-22 14:24:47 UTC - VirusTotal detections in the stored snapshot: 1/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Google ## Stored infrastructure - Observed IP address: 172.64.151.8 - Registrar in stored WHOIS data: MarkMonitor Inc. - Last stored HTTP status: 404 - Registration date (registry RDAP, webflow.io): 2013-05-08 02:20:57 UTC ## Evidence links - VirusTotal domain view: https://www.virustotal.com/gui/domain/tussaudsdubai----madame.webflow.io - Certificate Transparency search: https://crt.sh/?q=%25.tussaudsdubai----madame.webflow.io - Web Archive lookup: https://web.archive.org/web/*/https://tussaudsdubai----madame.webflow.io/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview This Webflow-hosted subdomain impersonates Madame Tussauds Dubai, the wax museum attraction. It aims at tourists and residents searching for the museum online. PhishDestroy first flagged it on 2026-09-16 and classified it as an impersonation phishing page. The site has been offline since 2026-09-22, and the root still served no content when last checked on 2026-10-19. How the scam works Attraction impersonation pages copy a venue's name and branding on a free site-builder address so they look like an official booking page. They usually push discounted or 'last-minute' tickets, then collect card details, names, phone numbers and email addresses through a checkout that leads nowhere. Victims lose the payment and expose card data that can be reused for further fraud. The repeated hyphens and the word order in this subdomain put the brand name up front, which can pass a quick glance on a phone screen. The page now returns the title '404 - Page not found', while our classification is impersonation phishing. Evidence Independent detection is thin. On 2026-09-23, only LevelBlue among 89 VirusTotal engines flagged the address, and PhishDestroy is the only blocklist listing it. This low count reflects how briefly the page was up, about six days between our first sighting and its takedown, rather than any sign that it is safe. Infrastructure The operator used a free Webflow subdomain instead of registering a domain, which costs nothing and avoids a registrar trail. Traffic resolves through Cloudflare, Inc. at 172.64.151.8, geolocated to Canada. The Google Trust Services certificate comes from the platform's shared setup, so the padlock says nothing about whether the page is legitimate. What to do If you paid or entered card details on this page, call your bank right away to block the card and dispute the charge, and watch your statements for small test transactions. If you shared an email address or phone number, expect follow-up 'booking confirmation' or refund messages and do not click their links. Buy Madame Tussauds Dubai tickets only through the attraction's official site or authorised resellers you reach yourself. Defenders should block this subdomain and similar brand-plus-hyphen patterns on webflow.io, and report any new variants to Webflow's abuse team. Useful links VirusTotal report: https://www.virustotal.com/gui/domain/tussaudsdubai----madame.webflow.io Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=tussaudsdubai----madame.webflow.io Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:18:02 UTC ## Stored page captures - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/c3d8b204-904a-47d4-8e7b-c0a5604017aa.png Captured: 2026-09-23 04:11:19 UTC Source report: https://radar.cloudflare.com/scan/c3d8b204-904a-47d4-8e7b-c0a5604017aa SHA-256: a380e448eb3101674f4c67f891f37ba29b76e79d0bcca3163d4b1510d947431b - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aa84-7d33-76a5-a75b-0046619af846.png Captured: 2026-09-16 14:00:11 UTC Source report: https://urlscan.io/result/01a0aa84-7d33-76a5-a75b-0046619af846/ SHA-256: eb5c94cb6493d810acd574bcc580f4dd214793336d58e0cc2f1c37cef86be766 - URLScan · 2026-09-16: https://screenshots.phishdestroy.io/us/01a0aa84-7a98-765e-9f74-1dd194307901.png Captured: 2026-09-16 14:00:11 UTC Source report: https://urlscan.io/result/01a0aa84-7a98-765e-9f74-1dd194307901/ SHA-256: eb5c94cb6493d810acd574bcc580f4dd214793336d58e0cc2f1c37cef86be766 - URLScan · 2026-09-17: https://screenshots.phishdestroy.io/us/01a0af12-0750-7579-8613-72a917eddd46.png Captured: 2026-09-17 11:13:16 UTC Source report: https://urlscan.io/result/01a0af12-0750-7579-8613-72a917eddd46/ SHA-256: eb5c94cb6493d810acd574bcc580f4dd214793336d58e0cc2f1c37cef86be766 - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd2e-040e-707c-aba7-d92430b9dd77.png Captured: 2026-09-23 07:32:26 UTC Source report: https://urlscan.io/result/01a0cd2e-040e-707c-aba7-d92430b9dd77/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 - URLScan · 2026-09-23: https://screenshots.phishdestroy.io/us/01a0cd2e-0419-753b-8fb5-dc28a92a9c55.png Captured: 2026-09-23 07:32:36 UTC Source report: https://urlscan.io/result/01a0cd2e-0419-753b-8fb5-dc28a92a9c55/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 - URLScan · 2026-09-25: https://screenshots.phishdestroy.io/us/01a0d916-205b-7435-98b9-8b4b0964e835.png Captured: 2026-09-25 15:01:58 UTC Source report: https://urlscan.io/result/01a0d916-205b-7435-98b9-8b4b0964e835/ SHA-256: 962d9b008c24974ac8ab07b7680a01b3be95a4009018c7bd0fb6b74f91b391f1 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "cf": { "v": 1, "fetched_at": "2026-10-20T22:29:46Z", "uuid": "c3d8b204-904a-47d4-8e7b-c0a5604017aa", "scanned_at": "2026-09-23T04:11:19Z", "final_url": "https://tussaudsdubai----madame.webflow.io/", "status": 404, "history": [ { "url": "https://tussaudsdubai----madame.webflow.io/", "status": 404 } ], "dom_hash": "4932075438459d054af6b75a0d6585b123ae775f36579c095159b2af33360488", "doc_hash": "90c032f35272ba1a7aa93027ab635e6610d4f24cf9e53c0624d00f065d7c7e7d", "domain_risks": [ "Phishing", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "tussaudsdubai----madame.webflow.io", "type": "A", "value": "172.64.151.8" }, { "name": "tussaudsdubai----madame.webflow.io", "type": "A", "value": "104.18.36.248" }, { "name": "tussaudsdubai----madame.webflow.io", "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "name": "tussaudsdubai----madame.webflow.io", "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" } ], "dnssec_valid": false, "ip": "172.64.151.8", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "expires": "2028-05-08T02:20:57Z", "nameservers": [ "lamar.ns.cloudflare.com", "journey.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T00:28:16Z", "analysis_at": "2026-10-16T14:41:57Z", "stats": { "timeout": 0, "harmless": 46, "malicious": 13, "suspicious": 0, "undetected": 33 }, "detections": { "ESET": "phishing", "VIPRE": "malware", "G-Data": "phishing", "Lionic": "phishing", "Sophos": "phishing", "CyRadar": "phishing", "Webroot": "malicious", "Fortinet": "phishing", "LevelBlue": "phishing", "Seclookup": "malicious", "BitDefender": "phishing", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "registrar": "MarkMonitor Inc.", "created": "2013-05-08T02:20:57Z", "expires": "2028-05-08T02:20:57Z", "updated": "2026-08-12T04:04:30Z", "first_seen": "2026-09-16T13:11:19Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.64.151.8" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3102::ac40:9708" }, { "ttl": 300, "type": "A", "value": "104.18.36.248" }, { "ttl": 300, "type": "AAAA", "value": "2a06:98c1:3105::6812:24f8" } ], "dns_at": "2026-10-16T14:47:12Z", "jarm": "27d27d27d00027d00042d43d00041df04c41293ba84f6efe3a613b22f983e6", "cert": { "san": [ "webflow.io", "*.webflow.io" ], "issuer": "Google Trust Services / WE1", "serial": "ac972ef95a18ab8f0e5a2917e958d6da", "sha256": "5302eb12d2c1ddc8020e4565aef253a59e28b4a9aede60f73e4fe6cb516fd2a7", "subject": "webflow.io", "valid_to": "2026-12-21T03:46:57Z", "valid_from": "2026-09-22T02:47:08Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2013-05-08T02:20:57Z", "updated": "2025-02-25T20:53:31Z", "expires": "2028-05-08T02:20:57Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited" ], "nameservers": [ "journey.ns.cloudflare.com", "lamar.ns.cloudflare.com" ], "dnssec": "unsigned" } } } ```