booking-comduubai[.]webflow[.]io

Analysis of booking-comduubai.webflow.io indicates that the domain was registered on June 12, 2026 through the Webflow platform, a service commonly used for rapid site deployment. The domain resolves to the IP address 172.64.151.8, which is owned by Cloudflare’s edge network and does not provide direct insight into the underlying host. The domain appears on a single security blocklist and is listed by PhishDestroy as a blocked entry, reflecting that at least one reputable anti‑phishing feed has identified it as malicious. VirusTotal scans show that 10 of 91 security vendors have flagged the domain, reinforcing the suspicion of malicious activity.

The threat classification supplied is "generic phishing," and the risk level is marked as elevated with an active status, suggesting ongoing use. No additional public evidence such as page title, SSL certificate details, or Safe Browsing verdicts are provided, leaving the content of the site unverified. The limited number of blocklist entries and vendor detections may indicate that the campaign is relatively new, consistent with the recent registration date. However, the presence on PhishDestroy and multiple VirusTotal detections is sufficient for defensive operators to treat the domain as hostile.

Defenders should block any network traffic to booking-comduubai.webflow.io at the perimeter and update endpoint and web‑filter policies to include the domain and its resolved IP address. Continuous monitoring of the IP 172.64.151.8 for new associations is advised, as Cloudflare‑hosted domains can share infrastructure with other malicious sites. Organizations using Webflow should consider additional scrutiny of newly created subdomains that resolve to Cloudflare edges, especially when they appear on phishing feeds. Further investigation, such as retrieving the live page content and analyzing HTTP response headers, would clarify the exact phishing vector and aid in attribution.